Software Specification, Verification and Validation (CIS 775)

1
Software Specification, Verification and
Validation (CIS 775)

• Elsa L Gunter
• 4303 GITC
• NJIT, http//www.cs.njit.edu/elsa/775-spring2004

2
Promela Model

• A Promela model consist of
• Type declarations
• mtype, typedefs, constants
• Channel declarations
• chan ch dim of type, ...
• asynchronous dimgt 0
• rendez-vous dim 0
• Global variable declarations
• can be accessed by all processes

3
Promela Model

• Process declarations
• behaviourof the processes
• local variables statements
• initprocess
• initializes variables and starts processes

4
Processes

• A process type(proctype) consist of
• a name
• a list of formal parameters
• local variable declarations
• body

5
Example
formal paramters
name

• proctype Sender(chan in chan out)
• bit sndB, rcvB
• do
• out ! MSG, sndB -gt
• in ? ACK, rcvB
• if
• sndB rcvB -gt sndB 1-sndB
• else -gt skip
• fi
• od

local variables
The body consists of a sequence of statements
body
6
Processes

• A process
• is defined by a proctype definition
• executes concurrently with all other processes,
  independent of speed of behavior
• Communicate with other processes
• using global (shared) variables
• using channels

7
Processes

• There may be several processes of the same
  proctype
• Each process has its own local state
• process counter(location within the proctype)
  contents of the local variables

8
Processes

• Process are created using the run statement
  (which returns the process id)
• Processes can be created at any point in the
  execution (within any process)
• Processes start executing after the run
  statement.
• Processes can also be created by adding active
  in front of the proctype declaration
• Parameters will be initialized to 0

9
Example Hello World!

• / A "Hello World Promela model for SPIN. /
• active proctype Hello( )
• printf("Hello process, my pid is
  d\n",_pid)
• init
• int lastpid
• printf("init process, my pidis d\n", _pid)
  lastpid run Hello()
• printf("last pid was d\n",lastpid)

10
Running Example in SPIN

• SPIN Called in random simulation mode
• elsa spin -n2 hello.pr
• init process, my pidis 1
• lastpidwas 2
• Hello process, my pid is 0
• Hello process, my pid is 2
• 3 processes created

11
Variables and Types

• Five different (integer) basic types.
• Arrays
• Records(structs)
• Type conflicts are detected at runtime
• Default initial value of basic variables (local
  and global) is 0.

12
Variables

• Variables should be declared.
• Variables can be given a value by
• assignment
• argument passing
• message passing (see communication)
• Variables can be used in expressions
• Most arithmetic, relational, and logical
  operators of C/Java are supported, including
  bitshift operators.

13

• int ii
• bit bb
• bb1
• ii2
• short s-1
• typedef Foo
• bit bb
• int ii

• Foo f
• f.bb 0
• f.ii -2
• iis27 23
• printf(value d, ss)

14
Basic types

• Declarations Range
• bit turn1 0..1
• bool flag 0..1
• byte counter 0..255
• short s1, s2 -216-1.. 2161
• int msg -232-1.. 2321

15
Arrays

• Declarations
• byte a27
• bit flags4
• Same as C/C
• Array indicing start at 0

16
Records

• Type definitions (records)
• typedef MyRecord
• short f1 byte f2
• Variable declaration
• MyRecord rr
• Field update
• rr.f1
• rr.f2

17
Message types and channels

• mtype OK, READY, ACK, ERROR
• mtype Mvar ACK
• chan Ng2 of byte, byte, mtype,
  Next0 of byte
• mtype allows an enumeration type in Promela

18
Expressions

• Arithmetic , -, , /,
• Comparison gt, gt, lt, lt, , !
• Boolean , , !
• Assignment
• Increment/decrement , --

19
Statements

• The body of a process consists of a sequence of
  statements
• A statement is either
• executable the statement can be executed
  immediately
• blocked the statement cannot be executed
• Executable/blocked depend son the global stateof
  the system.

20
Executable Statements

• An assignment is always executable
• An expression is also a statement it is
  executable if it evaluates to non-zero
• 2 lt 3 always executable
• x lt 27 only executable if value of xis smaller 27
• 3 x executable if x is not equal to 3

21
Statements

• The skip statement is always executable
• does nothing, only changes process process
  counter
• A run statement is only executable if a new
  process can be created (remember the number of
  processes is bounded)
• A printf statement is always executable(but is
  not evaluated during verification, of course)
• Statements in a sequence are separated by a
  semi-colon
• Statement in a sequence isnt executable until
  previous statement executed

22
Sample

• int x
• proctype A( )
• int y1
• skip
• run N( )
• x2
• xgt2 y0
• skip

Executable if N can be created...
Can only become executable if a some other
process makes x greater than 2
23
assert(ltexprgt)

• The assert statement is always executable
• If ltexprgt evaluates to zero, SPIN will exit with
  an error, as the ltexprgthas been violated
• The assert statement is often used within Promela
  models, to check whether certain properties are
  valid in a state
• proctype monitor() assert(n lt 3)
• proctype receiver() ...
• toReceiver ? msg
• assert(msg !ERROR)
• ...

24
if-statement

• if choice1 -gt stat1.1 stat1.2 stat1.3 ...
• choice2 -gt stat2.1 stat2.2 stat2.3 ...
• ...
• choicen -gt statn.1 statn.2 statn.3 ...
• fi
• if choice1 -gt stat1.1 stat1.2 stat1.3 ...
• choice2 -gt stat2.1 stat2.2 stat2.3 ...
• ...
• else-gt statn.1 statn.2 statn.3
• fi

25
if statement - Examples

• if
• x21 -gt zzy x--
• x20 -gt yyy xx/2
• fi
• if
• (n 2 ! 0) -gt n1
• (n gt 0) -gt nn-2
• (n 3 0) -gt n3
• else -gt skip
• fi

26
if-statement

• If there is at least one choicei (guard)
  executable, the if statement is executable and
  SPIN non-deterministically chooses one of the
  executable choices
• If no choicei is executable, the if-statement is
  blocked
• The operator -gtis equivalent to
• The else guard becomes executable if none of the
  other guards is executable

27
do-loops

• do
• choice1 -gt stat1.1 stat1.2 stat1.3 ...
• choice2 -gt stat2.1 stat2.2 stat2.3 ...
• ...
• choicen -gt statn.1 statn.2 statn.3 ...
• od

28
do-loops

• With respect to the choices, a do statement
  behaves in the same way as an if statement
• However, instead of ending the statement at the
  end of the chosen list of statements, a
  do-statement repeats the choice selection
• The (always executable) break statement exits a
  do-loop statement and transfers control to the
  end of the loop

29
Looping - Example

• do
• xgty -gt xx-y
• ygtx -gt yy-x
• else goto outside
• od
• outside

30
Goto

• goto label
• Transfers execution to label
• each Promela statement might be labeled
• quite useful in modeling communication protocols

31
Looping - Example

• do
• xgty -gt xx-y
• ygtx -gt yy-x
• else goto outside
• od
• outside

32
Interleaving Semantics

• Promela processes execute concurrently
• Non-deterministic scheduling of the processes
• Processes are interleaved (statements of
  different processes do not occur at the same
  time)
• exception rendez-vous communication

33
Interleaving Semantics

• All statements are atomic each statement is
  executed without interleaving with other
  processes
• Each process may have several different possible
  actions enabled at each point of execution
• only one choice is made, non-deterministically.
  i.e. randomly

34
atomic

• atomic st1 st2 ... stn
• can be used to groups tatements into an atomic
  sequence
• all statements are executed in a single step (no
  interleaving with statements of other processes)
• is executable if st1 is executable
• if a sti(with igt1) is blocked, the atomicity
  token is (temporarily) lost and other processes
  may do a step no pure atomicity
• (stronger version d-step)

35
Recall Example

• L0While True do
• NC0wait(Turn0)
• CR0Turn1
• endwhile
• L1While True do
• NC1wait(Turn1)
• CR1Turn0
• endwhile

36
General structure

• loop
• Non_Critical_Section
• TRWait_Protocol
• CRCritical_Section
• Post_protocol
• end loop

• Propositions
• inCR0, inTR0, inCR1, inTR1

37
Properties

• loop
• Non_Critical_Section
• TRWait_Protocol
• CRCritical_Section
• Post_protocol
• end loop

• Assumption
• ltgtinCRi
• Requirements
• (inCR0/\inCR1)
• (inTRi--gtltgtinCRi)
• Not assuming
• ltgtinTRi

38
Turnbit1

• task P0 is
• begin
• loop
• Non_Critical_Sec0
• Wait Turn0
• Critical_Sec
• Turn1
• end loop
• end P0.

• task P1 is
• begin
• loop
• Non_Critical_Sec1
• Wait Turn1
• Critical_Sec
• Turn0
• end loop
• end P1.

39
Translating into SPIN

• define critical (incrit0 incrit1)
• byte turn0, incrit20
• proctype P (bool id)
• do
• 1 -gt
• do / Non_Crit_Sec_id /
• 1 -gt skip
• 1 -gt break
• od

• trydo / Wait turn id /
• turnid -gt break
• od
• crincritid1 / Crit_Sec /
• incritid0
• turn1-turn
• od
• init atomic
• run P(0) run P(1)