Chapter 4: Model Checking of Finite State Systems

1
Chapter 4 Model Checking of Finite State Systems

• Albert M. K. Cheng

2
Model Checking
Is the finite-state graph a model of the
temporal logic formula?
Specification represented as a labeled finite-stat
e Graph (Kripke structure)
Safety assertion written as temporal logic formula
3
Computation Tree Logic CTL

• Propositional, branching-time temporal logic
• Next-time operator X, Until operator U
• A(E)X f f holds in every (some) immediate
  successor of current state

• A(E)f1 U f2 for every (some) computation
  path, there exists an initial prefix of the path
  such that f2 holds at the last state of the
  prefix and f1 holds at all other states along the
  prefix

4
Example Solution to Mutual Exclusion Problem
N1,N2
T1,N2
N1,T2
C1,N2
T1,T2
T1,T2
N1,C2
C1,T2
T1,C2
5
CTL abbreviations

• AF(f) ATrue U f
• f holds in the future along every path from
  the initial state s0, so f is inevitable
• EG(f)
• NOT AF(NOT f)

• EF(f) ETrue U f there is some path from the
  initial state s0 that leads to a state at which f
  holds, so f potentially holds
• AG(f)
• NOT EF(NOT f)

6
Explicit-State Model Checking

• for (fiflength fi gt 1 fi--)
• labelgraph(fi,s,correct)
• labelgraph (fi,s,b)
• short fi, s
• Boolean b
• short i
• switch(nffi-10.opcode)
• case atomic
• atf(fi,s,b)
• break

• case nt
• ntf(fi,s,b)
• break
• case ad
• adf(fi,s,b)
• break
• case ax
• axf(fi,s,b)
• break
• case ex
• exf(fi,s,b)
• break

7
Explicit-State Model Checking
case au for (i0 i
lt numstates i)
markedi false for (i0 i
lt numstates i) if
(!markedi)
auf(fi,s,b) break
case eu euf(fi,s,b)
break
8
Symbolic Model Checking

• Transition relation between the values of the
  variables in the current and the next states can
  be stated as a Boolean formula
• Use Binary Decision Diagrams (BDDs) to present
  this Boolean formula
• Apply model checker to finite-state graph
  represented as BBDs

9
Real-Time CTL

• Existentially Bounded Until operator
• Ef_1 Ux,y f_2 at state s_0 means there
  exists a path beginning at s_0 and some i such
  that x lt i lt y and f_2 holds at state s_i and
  forall j lt i, f_1 holds at state s_j
• Min/max delays
• Min/max number of condition occurrences