SYMBOLIC MODEL CHECKING: 1020 STATES AND BEYOND

J.R. BurchE.M. Clarke

K.L. McMillanD. L. Dill

L. J. Hwang

Presented byRehana Begam

Motivation Definitions Symbolic Model Checking Contribution

Mu-Calculus Encoding Binary Decision Diagram Representation Model Checking Algorithm

CTL Model Checking Empirical Results Summary Future Work

OUTLINE

Many different methods for automatically verifying finite state systems LTL CTL

All rely on algorithms that explicitly represent a state space, using a list or table that grows in proportion to the number of states

Number of states in the model grow exponentially with the number of concurrently executing components

The size of the state table is the limiting factor in applying these algorithms to realistic systems

MOTIVATION

This “state explosion problem” can not be handled by the state enumeration methods

Explicit state enumeration methods are limited to systems with at most 108 reachable states

Can be eliminated by representing the state space symbolically instead of explicitly

This technique verifies models with more than 1020 states !

MOTIVATION

Relational variable a predicate or a function

Abstraction operatorλ: used in lambda calculus f(x1, x2) is written as λ x1, x2[f]

Relational term f is a formula and yi are individual variables

R is relational term and P is a relational variable with arity n

Fixed point of function fAn element x such that f(x) = x

DEFINITIONS

Least fixed point is the least element that is a fixed point. y is lfp of f in S iff

(f(y) = y) ( x S . (f(x) = x) (y x))∧ ∀ ⇒ ⊆Greatest fixed point is the greatest element that is a fixed

point. y is gfp of f in S iff

(f(y) = y) ( x S . (f(x) = x) (x y))∧ ∀ ⇒ ⊆ Fixed point operators

μ and ν are the lfp and gfp operators used in mu-calculus Monotone function

A function f is monotone iff for all P S and Q⊆ S,⊆P Q f(P) f(Q)⊆ ⇒ ⊆

DEFINITIONS

Variable Interpretation Individual IP: for each individual variable y, IP(y) is a value in

domain D Relational IR: for each n-ary relational variable P, IR(P) is an

n-ary relation in domain D Substitution of Variables

The substitution of a variable w for a variable v in a formula f, denoted f(v ← w)

f <v ← w> ⇒ ∃v [(v ⇔ w) ∧ f]

DEFINITIONS

In explicit state model checking, we represent the Kripke structure as a graph and implement the model checking algorithm as graph traversal.

2 main steps: Encode Model Domain:

Describe sets of states as propositional logic formulae instead of enumeration: Mu-CalculusS = {1, 2, 3, 4, 5} = {x | 1 ≤ x ≤ 5}

Compact Representation:Represent those logical formulae/boolean functions using efficient means of manipulating boolean functions: Binary Decision Diagrams

SYMBOLIC MODEL CHECKING

Provides a generalized symbolic model checking method by using a dialect of the Mu-Calculus as the primary specification language

Describes a model checking algorithm for Mu-Calculus formulas that uses BDD to represent relations and formulas

Shows how Mu-Calculus model checking algorithm can be used to derive efficient decision procedures for CTL, LTL model checking

Discusses how it can be used to verify a simple synchronous pipeline circuit

CONTRIBUTIONS

Syntax:

In this formula, R can be a Relational variable or a Relational term of the following two forms:

Second one represents the least fixed point of R where R be formally monotone with P

MU-CALCULUS

Example:

MU-CALCULUS

Formal Definition: given a finite signature each symbol in is either an Individual variable or a

Relational variable with some positive arity. recursively define two syntactic categories: formulas

and relational terms. Formula:

MU-CALCULUS

Relational term:

∀, , , and are treated as abbreviations in the usual ∧ ⇒ ⇔manner

¬R is an abbreviation for R R’ is an abbreviation for ∨

MU-CALCULUS

Model M = (D, IR, ID), where D is the domain Semantic function

MU-CALCULUS

MU-CALCULUS

Widely used in various tools for the design and analysis of digital circuits

Canonical form representation for Boolean formulas

Similar to binary decision tree Allows many practical systems with extremely

large state spaces to be verified-which are impossible to handle with explicit state enumeration methods

BINARY DECISION DIAGRAM

DAG Occurrence of variables is

ordered from root to a leaf. Example:

Formula: (a b) (c d)∧ ∨ ∧ Ordering: a < b < c < d (a ←1, b ← 0, c ← 1, d ← 1)

leads to a leaf node labeled 1

BINARY DECISION DIAGRAM

For the Mu-Calculus that uses BDDs as its internal representation BDDATOM(f)

returns BDD iff f = 1 Last case substitutes

xi by dummy di

FixedPoint() is the standard technique

MODEL CHECKING ALGORITHM

CTL formula f is true of Kripke structure M= (A, S, L, N, SO) Mu-Calculus formula ⇔ f' is true of a structure M’ = (S, IR, ID)

If CTL formula f is an abbreviation for the Mu-Calculus relational term R, then f is true at state s iff R(s) is true

If f has no temporal operators, then it represents the relational term R

CTL MODEL CHECKING

EX f = λS [ ∃t [ f(t) N(s, t) ] ]∧ EG f = f EX EG ∧ f

= νQ [ f EX Q∧ ] = νQ [ λS [ f(s) ∧ ∃t [ Q(t) N(s, t) ] ]∧

E [ f g ] = g (∪ ∨ f EX E[f g])∧ ∪ = μQ [g (∨ f EX Q]]∧ = μQ [λS [g(s) (f(s) ∨ ∧ ∃t [Q(t) N(s, ∧

t)]]

CTL MODEL CHECKING

Performs three-address logical and arithmetic operations on a register

3 Pipeline stages: Operand read from the

register fileALU (Arithmetic Logic Unit)

operationWrite back to register

EMPIRICAL RESULTS

Pipeline with 12 bits has approximately 1.5 x 1O29 reachable states

The number of nodes in BDD is asymptotically linear in the number of bits, not exponential

The verification time is polynomial in the number of bits

EMPIRICAL RESULTS

Suitable encoding of the model domain and compact representation for relations, the complexity of various graph-based verification algorithms is reduced

Regular structure of the data path logic captured by the BDD representation results in a linear space complexity in the number of circuit components rather than exponential

SUMMARY

Characterization of the models for which the BDD Mu-Calculus checker is efficient

Applicability of developed technique in common graph algorithms whose results can be expressed as relations, such as minimum spanning trees, graph isomorphism etc.

FUTURE WORKS