Diapositiva 1 - uni
Download
Report
Transcript Diapositiva 1 - uni
Verification of Graph
Transformation
Systems
Arman Sheikholeslami
[email protected]
Graph and GTS
β’ Directed Graph πΊ = π, πΈ
β π is set of vertices.
β πΈ is set of edges.
β often used to model static characteristics of a system.
β’ Graph Transformation System πΊππ = πΊ0 , π
β used to model behavior of a dynamic system.
β πΊ0 as initial graph.
β π
as a set of transformation rules.
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
2
Chess
Transformed!
Rook
A8
B8
Pawn
A7
B7
Transformed!
A6
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
Rook
Pawn
A8
B8
A7
B7
A6
3
How Transformation works?
1. Find a matching of πΏπ»π in πΊ.
2. Delete all vertices π and edges πΈ in πΊ s.t. π, πΈ β πΏπ»π \ π
π»π.
3. Add all vertices π and edges πΈ to π» s.t. π, πΈ β π
π»π \ πΏπ»π.
A7
A6
Pawn
A7
Pawn
A6
LHS
RHS
Pawn
A7
A7
Pawn
A6
A6
A5
A5
G
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
H
4
Formalization of GTS
β’ Algebraic approach
A7
β Single push-out (SPO)
β’ If node deletion causes
dangling edge, node is
deleted along with dangled
edge.
Pawn
LHS
A7
A7
RHS
Pawn
A7
A6
A6
G
H
β Double push-out (DPO)
β’ If node deletion causes
dangling edge, the rule is
not applied.
β’ Not applicable in chess!
A7
Pawn
LHS
A7
Pawn
RHS
Pawn
Pawn
A6
A6
G
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
H
5
Transition System using SPO
A7
Pawn
A6
A5
Knight
B5
Pawn
Rule X
A7
Knight
LHS
Rule Z
RHS
P
A7
A6
A6
A5
A5
LHS
A7
Pawn
A7
Knight
B5
RHS
A6
A7
A5
P
Rule Y
Pawn
A6
P
Rule X
B5
A7
Rule Y
A7
A6
A6
A6
A5
P
A7
A5
B5
K
A6
A5
A7
P
B5
P
A6
A5
LHS
B5
RHS
Rule Z
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
6
Verification of GTS
β’ Verification is to determine if behavior of system
(semantic) to conform with specifications (properties).
β’ Properties of GTS
β conditions and restrains a GTS should satisfy.
β’ Semantic of GTS
β producible transition system.
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
7
Properties of GTS
β’ Which properties of GTS can be
verified?
β Safety
β’ something bad will never happen.
β’ e.g. a forbidden pattern (sub-graph) is
never reached.
β Liveness
β’ something good will eventually happen.
β’ e.g. Deadlock-freedom, security
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
Pawn
A7
Knight
A6
A5
B5
Knight hit by
Pawn!
Unsafe!
8
Intuitivelyβ¦
A7
Pawn
Knight
A6
A5
B5
Hit pattern,
Unsafe!
Pawn
Rule X
A7
Knight
LHS
RHS
P
A7
K
A6
A5
A7
P
A6
A5
B5
B5
LHS
A7
Pawn
A6
A5
RHS
Rule Y
Pawn
A7
P
Rule X
B5
Rule Z
A7
A6
A6
A6
A5
P
A7
A6
B5
A5
A7
K
A6
B5
A5
A7
P
B5
P
A6
A5
LHS
B5
RHS
Rule Z
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
9
Technicallyβ¦
A
Chess play
Transition
System
B
C
D
Semantics
Properties
Kripke
Structure
Temporal
Logic
Avoid
getting hit!
E
LTL:
β‘οΏ’B
οΌ
Model
Checker
οΌ
οΌ
ο»
οΌ
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
10
State space explosion
β’ Problem statement
x,y
β several variables in a system
with range of possible values.
β a state assigned to each
possible concrete combination
of variables.
β set of possible states is too
large.
π₯, π¦ β πππ‘ππππ
π₯, π¦ β {1,2, β¦ , 232 }
232 × 232
= 18,446,744,073,709,551,616
β’ This happens in almost every
system
β Thatβs why we cannot have a
complete verification of large
systems e.g. OS.
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
11
Infinite State Space
β’ A worse case of State Space
Explosion problem.
LHS
RHS
β’ Occurs when state set of
system is endless.
β’ Infinite state space is created
by application of rules in which
LHS can be found in RHS.
G
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
H
12
Solutions
β’ Under-approximation
β An abstraction (subset) of original graph (state set) satisfying
less properties.
β’ Bounded Model Checking
β’ Over-approximation
β An abstraction (superset) of original graph (state set) satisfying
more properties.
β’ Shape Graphs
β’ Inductive Invariance
β’ Applicable to both State Space Explosion and Infinite
State Space problems
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
13
Bounded Model Checking
β’ π΅ is the pre-defined
absolute bound.
β’ Look for a bad pattern in πΎbounded execution length.
β’ If no bad pattern found,
increment πΎ (0 β€ πΎ β€ π΅)
until a bad pattern is found.
β’ If πΎ = π΅ and no bad pattern
found, verification stops.
β system is not necessarily safe
(under-approx.)
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
πΎ=1
πΎ=2
π΅
Only movements
of one level are
modeled!
(K=1)
14
Shape Graphs
β’ To shrink state space by abstraction
β information is discarded.
β how to retrieve it to create concrete instances?
β’ Local Shape Logic (LSL)
β a way to express additional information about nodes and edges
in a graph.
β’ Shape graph is an abstract model
β concrete instances are built based on shape constraints.
β’ Still more than one precise instance can be produced
(over-approx.).
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
15
Shape Graphs (example)
Rook
A8
B8
Pawn
A7
B7
King
Abstraction
Cell
Rook
Bishop
SG
A6
Queen
Knight
Pawn
Constraints:
β’ There is exactly one Pawn
G
In π³πΊπ³π» :
1
β’
πππ€π Λβπππ€π 1 πππ€π
Rook
Pawn
A8
A7
Rook
A8
B8
Pawn
A7
B7
π΄7
B8
B7
A6
Pawn
A6
G
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
G
16
Inductive Invariance
β’ Investigate if transition from a safe state to an error state
(forbidden pattern) is possible
β Apply the rules backwards from forbidden pattern.
β if safe state reached, the property is can be violated (itβs NOT
Inductive Invariant).
β’ Instead of the whole graph, only borders are investigated
(abstraction).
A7
Pawn
A6
A5
Knight
B5
A7
Pawn
A6
A5
Knight
B5
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
17
Inductive Invariant (cont.)
β’ If the property is inductive invariant
β no rule can be used to reach forbidden pattern from a state is not
forbidden pattern.
β the system is safe.
β’ If the property is not inductive invariant
β the system still might be safe.
β forbidden pattern can be reached given any starting graph (overapprox.).
D5
Bishop
Pawn
C3
C2
D8
D7
D4
E5
Bishop
Bishop
D3
C1
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
E4
E3
18
Extensions
β’ What if we need to differentiate
elements of graphs from each other?
β we need to use attributes to specify
differences.
β Typed Attributed Graphs (TAG)
introduces as extension.
β’ What if time has specific effect on
the system?
β simple graphs do not care about time!
β Timed Graphs introduces as extension
(also and extension to TAG).
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
19
Typed Attributed GTS
β’ A graph with vertices and edges having an attribute
β π΄πΊ(πΊ, π·) where πΊ is a graph and π· data vertices in πΊ.
β node attribute as data node with an edge from graph node to
data node.
β edge attribute as data node with an edge from graph edge to
data node.
Rook
A8
B8
Pawn
A7
B7
Black
A data node
indicating
color
A6
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
20
Timed GTS
β’ Contains 3 rules to perform TGT
1. Clock Instance Rule
β’ adds clock instances to graph.
β’ by using discrete- or dense-time model (timed automata), passing of
time can be expressed.
2. Invariant Rule
β’ restrict the execution of the rule to a specific time interval.
3. Timed Graph Transformation Rule
β’ normal graph transformation rule.
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
21
Timed GTS (example)
Rook
A8
P
A7
A7
LHS
1
A8
P
A6
A6
Pawn
Rook
A7
Apply
Clock
Instance
rule
A7
RHS
Rule X
Pawn
A6
A6
CI
A8
Apply
Transformation
rule
3
Yes
Rook
A7
Pawn
A6
R
A8
CI
LHS
No
A8
A7
A7
πΆπΌ β€ 10
R
RHS
Rule Y
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
2
Apply
Invariant
rule
22
Verification of TGTS
β’ There are many studies about model
checking of TCTL over timed automata.
β’ To reduce model checking TGTS to
model checking of timed automata.
β to benefit from existing theories and tools.
Timed GTS
FO-TCTL
Property
2
1
πΊπ‘ Automaton
TCTL
Property
3
β’
To do that
1.
2.
3.
produce TS for TGTS (πΊπ‘ -automaton).
reduce First Order-TCTL to TCTL.
label πΊπ‘ -automaton with atomic
propositions holding in states.
Labeled πΊπ‘ Automaton
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
TCTL Model
Checker
23
Verification of TGTS (example)
Inv: πΆπΌ β€ 10
A8
Rook
FO-TCTL
A7
A7
Pawn
Pawn
π΄πΊβ€10 (βπ₯)(πΆπΌ(π₯))
A6
A6
CI
CI
A8
Rook
Timed
GTS
A8
Rook
Rook
A7
A8
A7
Pawn
A6
π΄πΊβ€10 (πΆπΌ_π₯)
πΊπ‘ -Automaton
Pawn
A6
πΆπΌ β€ 10CI
CI
πΆπΌ β€ 10
TCTL
A8
Rook
Rook
A7
A7
Pawn
Pawn
A6
CI
A8
CI_x
πΆπΌ β€ 10
πΆπΌ β€ 10CI
πΆπΌ β€ 10
A6
CI_x
TCTL Model Checker
Labeled πΊπ‘ Automaton
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
24
Question?!
Seminar Advanced Verification Techniques - Winter term 2012/13 - University of Paderborn
25