Spin Model Checker Samaneh Navabpour Electrical and Computer

Spin Model Checker Samaneh Navabpour Electrical and Computer Engineering Department University of Waterloo SE-464 Summer 2011 1

Common Design Flaws n n n n Deadlock Livelock, Starvation Under-specification Over-specification Violation of Constraints Etc. Most of the errors caused by these flaws can be detected by model checking. 2

Model Checking and Spin n Model Checking: q n Is an automated technique that, given a finite model of a system and a logical property, systematically checks whether this property holds for that model. Spin is a well known classical model checker. q q q Aims towards concurrent systems Only checks functional properties Does not model real-time, but is capable of modeling timeouts. Abstract Verification Model Design abstraction Implementation refinement Model Checker 3

Material which needs to be covered n Spin Architecture q n JSpin q q n We wont cover How to install How to use it Promela q Basic building blocks 4

j. Spin n Install q q n Running j. Spin q n Create a directory for mingw, and install mingw in that directory. Create separate directory for Jspin. Download executable for Jspin in directory, and run executable. -javaw –jar j. Spin. jar (with optional Promela file). Demo jspin 5

j. Spin n Check q n Random q n Runs a random simulation. Interactive q n Runs a syntax check. Runs an interactive simulation. Guided q Runs a guided simulation using the trail file created by the execution of the analyzer. 6

Verification with j. Spin n With LTL formulas: q q formula must be converted to an automaton written as a Promela never claim. Remember to do Translated LTL formula's will be saved in a *. ltl file. Original LTL formulas can be saved in*. prp. 7

Verification with j. Spin n Without LTL formulas: q Safety Properties n q Acceptance cycles: n n q Using assertions Testing for acceptance cycles is generally testing for the absence of unwanted infinite behavior. Acceptance cycle is a cycle that infinitely often visits an acceptance state. Non-Progress cycles: n n Progress is the guarantee of wanted infinite behavior. Non-progress cycle is a cycle that does not visit a progress state infinitely often. 8

Promela n Promela consists of: q Processes n q Channels n q Describes the behavior of the system. Define the environment in which the processes run. Variables n n Define the environment in which the processes run. The scope of a variable is global if it is declared outside all process declarations, and local if it is declared within a process declaration. 9

Promela n Statements in Promela: n Are all conditional: A statement will only be executed if the condition of its execution is satisfied. Hence: Statement is either Executable or Blocked. Example: (a == b) is similar to While(a != b) { // Skip } q n Promela cant have unbounded q Data, Channels, Processes, Process Creation. 10

Promela-variables n Basic Types: q q q n Arrays q n Bit Bool Byte Short Int Byte test[9] Record q Typedef test {int test 1, byte test 2} 11

Promela-variables n Message type mtype q n mtype {int, byte} Channels q chan to. R = [6] of {mtype, bit} n Global Variables n Variables can be given values by: assignment, argument passing and message passing. 12

Promela-processes n Processes name execution number byte state; active [2] proctype P() { (state == 1) -> state = 3 } n n proctype P() { … } OR Init{ Int pid 2 = run P(); } Can be created by run or active. Can be created at any point. Processes can interact via channels or global variables. The run statement can pass parameter values of all basic data types to the new process. 13

Promela- Advanced Topics n atomic: q n Statements in atomic are executed as one indivisible unit, noninterleaved with any other processes. d_step: q q q proctype P() { atomic { (state==1) -> state = state+1 } } Similar to atomic Does not save intermediate states Can not contain non-determinism or blocking statements 14

Promela-Statements n If-statement: if : : (a >= b ) -> Stmt 1 ; Stmt 2 ; … : : (a < b ) -> Stmt 3 ; Stmt 4 ; … : : (a == b ) -> Stmt 5 ; Stmt 6 ; … : : else -> Stmt 7 fi n n n if : : count = count + 1 : : count = count – 1 fi If more than one guard is satisfied, we have nondeterminism. If all guards are un-executable the process will block until at least one of them can be selected. There is no restriction on the type of statements that can be used as a guard. 15

Promela-Statements n Do-statement do : : (a >= b ) -> Stmt 1 ; Stmt 2 ; … : : (a < b ) -> Stmt 3 ; Stmt 4 ; … : : (a == b ) -> Stmt 5 ; Stmt 6 ; … : : else -> Stmt 7 od n do : : count = count + 1 : : count = count – 1 : : (count == 0) -> break od Same as if-statement, only in a while loop. 16

Promela-Communication n Processes can communicate in two ways: q q Global variables Channels: n chan <name> = [<dim>] of {<type 1>, <type 2>, . . , <typen>} q n n n Asynchronously : dimension > 0 Synchronously : dimension = 0 Actions: q q n Example: chan to. R = [2] of {int, int} Sending : ch ! <expr_1>, . . , <expr_n> Receiving: ch ? var_1, . . , var_n to. R!(1, 5) ……. to. R? (x 1, x 2) If send and receive can not happen, process will block. 17

Promela-Statements n Special Statements: q q goto skip: same as 1 or true, run assert (<expr>) n check whether certain properties hold. Gives an error if violated. 18

Promela- Advanced Topics n Timeout q q q Promela has no real-time features The timeout statement can only be executed when no other statement in the system can be executed Can help get out of deadlock The timeout models a special condition that allows a process to abort the waiting for a condition that may never become true, e. g. an input from an empty channel. Example: do : : guard 1 -> Stmt 1; … : : timeout -> break ; … od 19

Conclusion n n n Spin is suitable for concurrent systems Can not model time JSpin is easy to install and use via the graphical interface Promela is similar to C, therefore easy to cope with. Beware of state explosion Need basic knowledge of LTL. 20

References n Spin official page q n Spin online tutorials q n http: //spinroot. com/spin/Man/index. html Jspin q n http: //spinroot. com http: //stwww. weizmann. ac. il/g-cs/benari/spin Erigone q http: //stwww. weizmann. ac. il/g-cs/benari/erigone 21