SYMBOLIC MODEL CHECKING : 10 20 STATES AND BEYOND

1. SYMBOLIC MODEL CHECKING: 1020STATES AND BEYOND J.R. Burch E.M. Clarke K.L. McMillan D. L. Dill L. J. Hwang Presented by RehanaBegam

2. OUTLINE • Motivation • Definitions • Symbolic Model Checking • Contribution • Mu-Calculus Encoding • Binary Decision Diagram Representation • Model Checking Algorithm • CTL Model Checking • Empirical Results • Summary • Future Work

3. MOTIVATION • Many different methods for automatically verifying finite state systems • LTL • CTL • All rely on algorithms that explicitly represent a state space, using a list or table that grows in proportion to the number of states • Number of states in the model grow exponentially with the number of concurrently executing components • The size of the state table is the limiting factor in applying these algorithms to realistic systems

4. MOTIVATION • This “state explosion problem” can not be handled by the state enumeration methods • Explicit state enumeration methods are limited to systems with at most 108 reachable states • Can be eliminated by representing the state space symbolically instead of explicitly • This technique verifies models with more than 1020 states !

5. DEFINITIONS • Relational variable • a predicate or a function • Abstraction operator • λ: used in lambda calculus • f(x1, x2) is written as λx1, x2[f] • Relational term • f is a formula and yi are individual variables • R is relational term and P is a relational variable with arity n • Fixed point of function f • An element x such that f(x) = x

6. DEFINITIONS • Least fixed point is the least element that is a fixed point. y is lfp of f in S iff (f(y) = y) ∧ (∀x S . (f(x) = x) ⇒ (y ⊆ x)) • Greatest fixed point is the greatest element that is a fixed point. y is gfp of f in S iff (f(y) = y) ∧ (∀x S . (f(x) = x) ⇒ (x ⊆ y)) • Fixed point operators • μ and ν are the lfp and gfp operators used in mu-calculus • Monotone function • A function f is monotone iff for all P ⊆ S and Q ⊆ S, P ⊆ Q ⇒ f(P) ⊆ f(Q)

7. DEFINITIONS • Variable Interpretation • Individual IP: for each individual variable y, IP(y) is a value in domain D • Relational IR: for each n-ary relational variable P, IR(P) is an n-ary relation in domain D • Substitution of Variables • The substitution of a variable w for a variable v in a formula f, denoted f(v ← w) f <v ← w> ⇒ ∃v [(v ⇔ w) ∧ f]

8. SYMBOLIC MODEL CHECKING • In explicit state model checking, we represent the Kripke structure as a graph and implement the model checking algorithm as graph traversal. • 2 main steps: • Encode Model Domain: Describe sets of states as propositional logic formulae instead of enumeration: Mu-Calculus S = {1, 2, 3, 4, 5} = {x | 1 ≤ x ≤ 5} • Compact Representation: Represent those logical formulae/boolean functions using efficient means of manipulating boolean functions: Binary Decision Diagrams

9. CONTRIBUTIONS • Provides a generalized symbolic model checking method by using a dialect of the Mu-Calculus as the primary specification language • Describes a model checking algorithm for Mu-Calculus formulas that uses BDD to represent relations and formulas • Shows how Mu-Calculus model checking algorithm can be used to derive efficient decision procedures for CTL, LTL model checking • Discusses how it can be used to verify a simple synchronous pipeline circuit

10. MU-CALCULUS • Syntax: • In this formula, R can be a Relational variable or a Relational term of the following two forms: • Second one represents the least fixed point of R where R be formally monotone with P

11. MU-CALCULUS • Example:

12. MU-CALCULUS • Formal Definition: • given a finite signature • each symbol in is either an Individualvariable or a Relational variable with some positive arity. • recursively define two syntactic categories: formulas and relational terms. • Formula:

13. MU-CALCULUS • Relational term: • ∀, ∧, ⇒, and ⇔ are treated as abbreviations in the usual manner • ¬R is an abbreviation for • R ∨ R’ is an abbreviation for

14. MU-CALCULUS • Model M = (D, IR, ID), where D is the domain • Semantic function

15. MU-CALCULUS

16. BINARY DECISION DIAGRAM • Widely used in various tools for the design and analysis of digital circuits • Canonical form representation for Boolean formulas • Similar to binary decision tree • Allows many practical systems with extremely large state spaces to be verified-which are impossible to handle with explicit state enumeration methods

17. BINARY DECISION DIAGRAM • DAG • Occurrence of variables is ordered from root to a leaf. • Example: • Formula: (a ∧ b) ∨ (c ∧ d) • Ordering: a < b < c < d • (a ←1, b ← 0, c ← 1, d ← 1) leads to a leaf node labeled 1

18. MODEL CHECKING ALGORITHM • For the Mu-Calculus that uses BDDs as its internal representation • BDDATOM(f) returns BDD iff f = 1 • Last case substitutes xi by dummy di • FixedPoint() is the standard technique

19. CTL MODEL CHECKING • CTL formula f is true of Kripke structure M= (A, S, L, N, SO) ⇔ Mu-Calculus formula f' is true of a structure M’ = (S, IR, ID) • If CTL formula f is an abbreviation for the Mu-Calculus relational term R, then f is true at state s iff R(s) is true • If f has no temporal operators, then it represents the relational term R

20. CTL MODEL CHECKING • EX f =λS [ ∃t [ f(t) ∧ N(s, t) ] ] • EG f = f ∧ EX EG f = νQ [ f ∧ EX Q] = νQ [ λS [ f(s) ∧ ∃t [ Q(t) ∧ N(s, t) ] ] • E [ f ∪ g ] = g ∨ (f ∧ EX E[f ∪ g]) = μQ [g ∨ (f ∧ EX Q]] = μQ [λS [g(s) ∨ (f(s) ∧ ∃t [Q(t) ∧ N(s, t)]]

21. EMPIRICAL RESULTS • Performs three-address logical and arithmetic operations on a register • 3 Pipeline stages: • Operand read from the register file • ALU (Arithmetic Logic Unit) operation • Write back to register

22. EMPIRICAL RESULTS • Pipeline with 12 bits has approximately 1.5 x 1O29 reachable states • The number of nodes in BDD is asymptotically linear in the number of bits, not exponential • The verification time is polynomial in the number of bits

23. SUMMARY • Suitable encoding of the model domain and compact representation for relations, the complexity of various graph-based verification algorithms is reduced • Regular structure of the data path logic captured by the BDD representation results in a linear space complexity in the number of circuit components rather than exponential

24. FUTURE WORKS • Characterization of the models for which the BDD Mu-Calculus checker is efficient • Applicability of developed technique in common graph algorithms whose results can be expressed as relations, such as minimum spanning trees, graph isomorphism etc.