Arias, Michell Guzm´ an and Carlos Olarte Universidade Federal do Rio Grande do Norte. Brasil. September 8, 2014 Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 1 / 30
computing, mobile computing, synchronous systems. Science: Biological and chemical systems. Arts: Multimedia Interaction. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 2 / 30
computing, mobile computing, synchronous systems. Science: Biological and chemical systems. Arts: Multimedia Interaction. Models of Concurrency Formal Models to describe and analyze concurrent systems. They must be: Simple. Expressive. Formal. Provide reasoning techniques. Some Examples: CCS [Mil89], the π-calculus [MPW92], CSP [Hoa85], CCP [Sar93]. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 2 / 30
of concurrency tied to logic with very interesting extensions: tcc, tccp,ntcc: Reactive and timed systems [SJG94, dBGM00, NPV02]. lccp: Linearity and resources [FRS01]. soft-ccp : Soft constraints and preferences [BMR06]. cc-pi, utcc: Mobility [BM07, OV08]. eccp and sccp: Epistemic and Spatial reasoning [KPPV12]. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 3 / 30
of concurrency tied to logic with very interesting extensions: tcc, tccp,ntcc: Reactive and timed systems [SJG94, dBGM00, NPV02]. lccp: Linearity and resources [FRS01]. soft-ccp : Soft constraints and preferences [BMR06]. cc-pi, utcc: Mobility [BM07, OV08]. eccp and sccp: Epistemic and Spatial reasoning [KPPV12]. Our goal Verifying properties of systems specified in CCP calculi. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 3 / 30
Simple (and beautiful!) closure operator semantics. Connection to Logic: e.g., relating CCP steps and Intuitionistic Linear Logic derivations. Frameworks: Calculus for proving correctness. Static Analysis: Abstract interpretation frameworks. Nevertheless... the automatic verification of CCP programs has received little attention so far. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 4 / 30
tools to carry out the verification of ntcc systems [NPV02]. A symbolic model for ntcc processes. 2 Showing a nice characterization of the temporal operators of the calculus. (Least and greatest) fixpoint characterization 3 Proving that the symbolic characterization is sound wrt the operational semantics. 4 Some technicalities on how to adapt our framework to use symbolic model checkers. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 5 / 30
concurrency that combines the operational view of processes and a declarative one based upon logic. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 8 / 30
concurrency that combines the operational view of processes and a declarative one based upon logic. Agents in CCP interact with each other by telling and asking constraints to a global store of partial information. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 8 / 30
concurrency that combines the operational view of processes and a declarative one based upon logic. Agents in CCP interact with each other by telling and asking constraints to a global store of partial information. The type of constraints and the entailment relation is given by a Constraint System (e.g. x > 42 |=∆ x > 0). Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 8 / 30
concurrency that combines the operational view of processes and a declarative one based upon logic. Agents in CCP interact with each other by telling and asking constraints to a global store of partial information. The type of constraints and the entailment relation is given by a Constraint System (e.g. x > 42 |=∆ x > 0). tell temperature > 42 ask temperature = 50 then P ask 0<temperature<100 then Q temperature=? tell temperature < 70 Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 8 / 30
concurrency that combines the operational view of processes and a declarative one based upon logic. Agents in CCP interact with each other by telling and asking constraints to a global store of partial information. The type of constraints and the entailment relation is given by a Constraint System (e.g. x > 42 |=∆ x > 0). ask temperature = 50 then P ask 0<temperature<100 then Q 42 <temperature<70 Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 8 / 30
concurrency that combines the operational view of processes and a declarative one based upon logic. Agents in CCP interact with each other by telling and asking constraints to a global store of partial information. The type of constraints and the entailment relation is given by a Constraint System (e.g. x > 42 |=∆ x > 0). ask temperature = 50 then P Q 42 <temperature<70 Remains Blocked Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 8 / 30
constraint) from the environment. 2 Computes a CCP process in the current time-unit and wait for stability. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 9 / 30
constraint) from the environment. 2 Computes a CCP process in the current time-unit and wait for stability. 3 Responds with the resulting store. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 9 / 30
constraint) from the environment. 2 Computes a CCP process in the current time-unit and wait for stability. 3 Responds with the resulting store. 4 Executes the Residual process in the next time-unit. * Note: Stores are not automatically transferred from a time unit to the next one. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 9 / 30
| tell(c) | j∈J ask cj then Pj | P Q | (local x) P | next P | unless c (next P) | P | !P j∈J ask cj then Pj chooses non-deterministically a Pj s.t. cj can be entailed from the store next P executes process P in the next time unit (unit-delay) unless c (next P) executes P in the next time unit if c cannot be deduced (preemption). P arbitrary long but finite delay for the activation of P (nextnP) !P executes a copy of P in each time-unit (replication) Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 10 / 30
Γ; c ∧ d) RT d |= ci , i ∈ J (X; j∈J ask cj then Pj , Γ; d) −→ (X; Pi , Γ; d) RA (X; !P; Γ; d) −→ (X; P, next !P; Γ; d) R2 n ≥ 0 (X; P, Γ; d) −→ (X; next nP, Γ; d) R What we observe during the time-unit Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 11 / 30
of processes. The interesting cases are those for the timed modalities ! and . 2 Step 2: Perform a fixpoint computation. 3 Step 3: Deal with dead-ends. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 15 / 30
· ◦n (cn) “c0 is valid in the current state and, after i observable transitions, ci holds. S(tell(c)) = c S( i∈I ask ci then Pi ) = i∈I (¬ci ) ∨ i∈I (ci ∧ S(Pi )) S(P Q) = S(P) ∧ S(Q) S(next P) = ◦(S(P)) S( P) = µY .(S(P) ∨ ◦(Y )) S(!P) = νY .(S(P) ∧ ◦(Y )) Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 16 / 30
= F(X1 , ..., Xn) be a formula where the variables X1 , .., Xn occur in F preceded by either µ or ν. The fixpoint of F can be reached in a finite number of steps. Theorem (Correctness) Let P be a process, F a solution for the equation S(P) and L be the LTS L(F). Consider an infinite sequence of constraints π. Then, π is a path in L iff P (π,π) = = = =⇒. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 17 / 30
| · false | c | F · ∧ F | F · ∨ F | · ¬F | ◦ F | 3F | 2F Liveness: 3c: the system eventually outputs the constraint c. Safety: 2c: c holds in all execution. Nice things 1 F is LTL satisfiable iff F is CLTL satisfiable [Val05]. 2 Model checking for LTL can be reduced to the symbolic MC of Computation Tree Logic (CTL) [CGH97]. 3 CLTL formulas can be efficiently represented as Difference Decision Diagrams (DDD). Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 19 / 30
φ: 1. Obtain the model M of the process P. 2. Compute the tableau for the (negated) formula ψ = ¬(φ ∧ 2 · ¬false). 3. Build the set F with all the fairness constraints, i.e., all the subformulas in ψ containing the U operator. 4. Obtain the product P between M and T . 5. Apply the CTL symbolic model checking algorithm with fairness constraints F over the symbolic product P and the property Etrue. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 20 / 30
a ntcc process. Output : PDF file with the generated Labelled Transition System. L A TEX file with the formula of the symbolic model. Model for NuSMV2 symbolic model checker. symbolicMC-NTCC file.ntcc 1http://www.labri.fr/perso/jarias/symbolicMC 2http://nusmv.fbk.eu Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 22 / 30
Next (Tell (on)) || Unless signal : Next Tell (off)) Output : on2 signal1 ^ off2 signal1 ¬signal1 signal1 ^ on2 ¬signal1 ^ off2 NuSMV > check_ltlspec -p "G (signal = TRUE -> X on = TRUE )" -- specification G (signal = TRUE -> X on = TRUE) is true NuSMV > check_ltlspec -p "G (signal = TRUE -> G on = TRUE )" -- specification G (signal = TRUE -> G on = TRUE) is false -- as demonstrated by the ... -> State: 1.1 <- signal = TRUE off = FALSE on = FALSE -> State: 1.2 <- signal = FALSE on = TRUE -- Loop starts here -> State: 1.3 <- off = TRUE on = FALSE Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 25 / 30
Such symbolic model can be used as input to a symbolic model checking algorithm. Hence we can automatically verify properties of ntcc systems. We plan to... Abstract the constraint system (symbolic-Abstract MC). Implement “hacks” to improve the performance of our tool. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 29 / 30
abstraction. Theoretical Computer Science, 37(1):77–121, 1985. Maria Grazia Buscemi and Ugo Montanari. Cc-pi: A constraint-based language for specifying service level agreements. In Rocco De Nicola, editor, ESOP, volume 4421 of Lecture Notes in Computer Science, pages 18–32. Springer, 2007. Stefano Bistarelli, Ugo Montanari, and Francesca Rossi. Soft concurrent constraint programming. ACM Trans. Comput. Log., 7(3):563–589, 2006. Edmund M Clarke, Orna Grumberg, and Kiyoharu Hamaguchi. Another look at ltl model checking. Formal Methods in System Design, 10(1):47–71, 1997. Frank S. de Boer, Maurizio Gabbrielli, and Maria Chiara Meo. A timed concurrent constraint language. Inf. Comput., 161(1), 2000. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 30 / 30
programming: Operational and phase semantics. Information and Computation, 165, 2001. C. A. R. Hoare. Communications Sequential Processes. Prentice-Hall, Englewood Cliffs (NJ), USA, 1985. Sophia Knight, Catuscia Palamidessi, Prakash Panangaden, and Frank D. Valencia. Spatial and epistemic modalities in constraint-based process calculi. In Maciej Koutny and Irek Ulidowski, editors, CONCUR, volume 7454 of Lecture Notes in Computer Science, pages 317–332. Springer, 2012. R. Milner. Communication and Concurrency. International Series in Computer Science. Prentice Hall, 1989. SU Fisher Research 511/24. R. Milner, J. Parrow, and D. Walker. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 30 / 30
of Information and Computation, 100, September 1992. M. Nielsen, C. Palamidessi, and F.D. Valencia. Temporal concurrent constraint programming: Denotation, logic and applications. Nordic Journal of Computing, 9(1), 2002. Carlos Olarte and Frank D. Valencia. Universal concurrent constraint programing: Symbolic semantics and applications to security. In Proc. of SAC 2008. ACM, 2008. Vijay A. Saraswat. Concurrent Constraint Programming. MIT Press, 1993. Vijay Saraswat, Radha Jagadeesan, and Vineet Gupta. Foundations of timed concurrent constraint programming. In Proc. of LICS’94. IEEE CS, 1994. Frank D. Valencia. Carlos Olarte (UFRN) Model Checking for CCP September 8, 2014 30 / 30