Patterns in Property Specifications for Finitestate Verification

1
Patterns in Property Specifications for
Finite-state Verification

• Matthew B. Dwyer, George S. Avrunin, and James C.
  Corbett
• ICSE, May,1999
• 2002.10.22
• Presented by Soon-deok, Kim

2
Contents

• Introduction
• Specification pattern system
• Property Specification Patterns
• Pattern scopes
• Specification Patterns System
• The Patterns
• Organization
• Pattern Mapping
• Survey of property specifications
• Conclusions
• Further Work

3
Introduction(1/3)

• Formal specification and verification offer
  practitioners some significant advantages
• Transition of this technology from research to
  practice has been slow
• Practitioners are unfamiliar with specification
  processes, notations, and strategies

4
Introduction(2/3)

• exgt Between the time an elevator is called at a
  floor and the time it opens its doors at that
  floor, the elevator can arrive at that floor at
  most twice

(Transitions to at a floor-state occur at most 2
times) Between call and open
AG( call -gt !E!open U (!atfloor !open
EX(atfloor E!open U (!atfloor
!open EX(atfloor E!open
U (!atfloor !open EX(atfloor !open
EF(open))))))))
5
Introduction(3/3)

• Specification pattern system is
• a collection of parameterizable, high-level,
  formalism-independent specification abstractions
• This paper adopted a pattern-based approach to
  presenting their specification abstractions
• Focus on the matching of problem characteristics
  to solution strategies
• Would also be successful in the domain of
  property specification for finite-state
  verification

6
Property Specification Patterns(1/2)

• Generalized description of a commonly occurring
  requirement on the permissible state/event
  sequences in a finite-state model of a system
• Describes the essential structure of some aspect
  of a systems behavior
• Provides expressions of systems behavior in a
  range of common formalisms

7
Property Specification Patterns(2/2)

• 5 basic patterns
• Universal
• To be true throughout the execution
• Absence
• Never true in the execution
• Existence
• Is true at some point in the execution
• Precedence
• Designated state/event always occurs before first
  occurrence of another designated state/event
• Response
• Designated state/event is followed by another
  designated state/event

8
Pattern Scopes(1/2)

• 5 basic scopes
• Global
• the entire program execution
• Before
• the execution up to a given state/event
• After
• the execution after a given state/event
• Between
• any part of the execution from one given
  state/event to another given state/event
• After-until
• like between but the designated part of the
  execution continues even if the second
  state/event does not occur

9
Pattern Scopes(2/2)
10
Specification Pattern System(1/8)

• A set of patterns
• Organized into one or more hierarchies with
  connections between related patterns
• Grow over time as developers encounter property
  specifications of real systems that do not easily
  map onto the existing patterns
• Hypothesis
• only a small fraction of the possible properties
  that can be specified commonly occur in practice

11
Specification pattern system(2/8)The
Patterns(1/2)

• Absence A given state/event does not occur
  within a scope
• Existence A given state/event must occur within
  a scope
• Bounded Existence A given state/event must
  occur k times within a scope.
• Universality A state/event occurs throughout a
  scope
• Precedence A state/event P must always be
  preceded by a state/event Q within a scope. Fig1
  gives the key elements of the pattern.

12
Specification pattern system(3/8)The
Patterns(2/2)

• Response A state/event P must always be
  followed by a state/event Q within a scope
• Chain Precedence -A sequence of states/events
  P1,.. , Pn must always be preceded by a sequence
  of states/events Q1,Qm.
• Chain Response A sequence of states/events
  P1,Pn must always be followed by a sequence of
  states/events Q1,Qm.

13
Specification pattern system(4/8)Organization

• Organize the patterns in a hierarchy based on
  their semantics

14
Specification pattern system(5/8) Patterns
Mapping(1/4)

• They provide mappings to
• Linear Temporal Logic (LTL)
• Computation Tree Logic (CTL)
• Quantified Regular Expressions (QREs)
• The Inca query language
• Graphical Interval Logic (GIL)
• Action Computation Tree Logic (ACTL)
• Regular Alternation-Free Mu-Calculus
• Tool accepting property specifications
• SPIN (accepts LTL)
• JavaPathFinder (accepts LTL)
• SMV (accepts CTL)
• FLAVERS (accepts QREs)
• CADP/EVALUATOR (accepts ACTL and Mu-Calculus)

15
Specification pattern system(6/8)Patterns
Mapping(2/4)

• Absence
• P is false

16
Specification pattern system(7/8)Patterns
Mappings(3/4)

• Response
• S response to P

(S response to P) between Q and R AG(Q !R -gt
A((P -gt A!R U (S !R)) AG(!R)) W R)
17
Specification pattern system(8/8)Patterns
Mappings(4/4)

• Bounded Existence
• Transitions to P-states occur at most 2 times

18
Survey of property Specifications(1/4)

• This paper assumed that the specifications people
  write fall into a small number of categories
• Empirical evidence for assumption
• Most fall into a small number of familiar
  categories
• Data Collection
• 555 specifications from at least 35 different
  source
• Wide variety of application domains

19
Survey of property Specifications(2/4)

• Total for Patterns/Scopes

20
Survey of property Specifications(3/4)

• Total Number of Instances for Patterns/Scopes

21
Survey of property Specifications(4/4)

• Percentage of Specifications for Each
  Pattern/Scope

22
Conclusions

• Their proposed specification system provides a
  set of commonly occurring high-level
  specification abstractions for formalisms
• Definition and use of high-level abstractions in
  writing formal specifications
• important factor in making automated formal
  methods
• Finite-state verification tools, more usable
• They have updated their pattern system to
  accommodate new patterns and variations of
  existing patterns in this survey

23
Further Work

• Defining a language for property specification
  based on the patterns
• Providing automated support for compiling
  properties expressed in that language to specific
  formalisms
• Checking the legality of pattern substitutions
• Approaches for checking the consistency of
  pattern mappings expressed in multiple formalisms