• Abstract and Figures
• Public Full-text

Temporal Verification of Reactive Systems Springer New York Berlin Heidelberg Barcelona Budapest Hong Kong London Milan Paris Tokyo Zohar Manna Amir Pnueli Temporal Verification of Reactive Systems Safety With 181 Illustrations , Springer Zohar Manna Amir Pnueli Department of Computer Science Computer Science Department Stanford University Weizmann Institute of Science Stanford, CA 94305 USA Rehovot, 76100 Israel Library of Congress Cataloging-in-Publication Data Manna, Zohar. Temporal verification of reactive systems:safety / Zohar Manna and Amir Pnueli. p. cm. Includes bibliographical references and index. ISBN-13:978-1-4612-8701-8 e-ISBN -13:978-1-4612-4222-2 D0I.10.100/978-1-4612-4222-2 1. Computer software-Verification. 2. Parallel processing (Electronic computers) I. Pnueli, A. II. Title. 005.2-dc20 95-5442 Printed on acid-free paper. @ 1995 Springer-Verlag New York, Inc. Softcover reprint of the hardcover 1st edition 1995 All rights reserved. This work may not be translated or copied in whole or in part without the written permission of the publisher (Springer-Verlag New York, Inc., 175 Fifth Avenue, New York, NY 10010, USA) except for brief excerpts in connection with reviews or scholarly analysis. Use in connection with any form of information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed is forbidden. The use of general descriptive names, trade names, trademarks, etc., in this publication, even if the former are not especially identified, is not to be taken as a sign that such names, as understood by the Trade Marks and Merchandise Marks Act, may accordingly be used freely by anyone. Production managed by Hal Henglein; manufacturing supervised by Joe Quatela. Photocomposed copy prepared from the authors' '!EX file. 987654321 ISBN-13:978-1-4612-8701-8 Springer-Verlag New York Berlin Heidelberg To our families: Nitza Ariela Yonit Shira Hagit Ishay Irit Noga Amit Preface This book is about the verification of reactive systems. A reactive system is a system that maintains an ongoing interaction with its environment, as opposed to computing some final value on termination. The family of reactive systems includes many classes of programs whose correct and reliable construction is con­ sidered to be particularly challenging, including concurrent programs, embedded and process control programs, and operating systems. Typical examples of such systems are an air traffic control system, programs controlling mechanical devices such as a train, or perpetually ongoing processes such as a nuclear reactor. With the expanding use of computers in safety-critical areas, where failure is potentially disastrous, correctness is crucial. This has led to the introduction of formal verification techniques, which give both users and designers of software and hardware systems greater confidence that the systems they build meet the desired specifications. Framework The approach promoted in this book is based on the use of temporal logic for specifying properties of reactive systems, and develops an extensive verification methodology for proving that a system meets its temporal specification. Reactive programs must be specified in terms of their ongoing behavior, and temporal logic provides an expressive and natural language for specifying this behavior. Our framework for specifying and verifying temporal properties of reactive systems is based on the following four components: 1. A computational model to describe the behavior of reactive systems. The model adopted in this book is that of a Fair Transition System (FTS). 2. A system description language to express proposed implementations. Here we use a Simple Programming Language (SPL) for this purpose. 3. A specification language to express properties that should be satisfied by any proposed implementation. The language of choice in this text is Temporal Logic (TL). viii Preface 4. Verification techniques to prove that the proposed implementation meets its prescribed specification. We consider two types of verification techniques. The first is a deductive approach, which provides a set of verification rules that reduce the task of proving a temporal property to checking the validity of first­ order formulas. The second is an algorithmic approach ("model checking") which presents algorithms for automatic verification of temporal properties. Figure A illustrates how the four parts of the framework interact. System Description Specification Language Language TL SPL Computational Model FTS Verification Techniques Fig. A. The four parts of the framework. Temporal properties of systems can be classified according to the form of the formulas expressing them. A safety property is a property that can be specified by a safety formula of the form 0 p (using the temporal operator 0 meaning always) . This formula states that the property p holds throughout the computa­ tion. Consider, for example, a system that controls the gates to a railroad cross­ ing. The requirement "whenever the train is passing, the gates should be down" Preface ix is a property expressible by a formula 0 p where p characterizes all states except those in which the train is passing while the gate is up. Typically, safety prop­ erties specify that nothing "bad" ever happens, such as allowing a train in the intersection while the gate is up. However, there are additional properties that cannot be specified by such safety formulas. For example, one such property expresses the requirement "if the intersection has been clear of trains for a sufficiently long time, then eventually a train will arrive or the gate will be raised." Properties that cannot be speci­ fied by a safety formula 0 p are called progress properties. Typically, progress properties specify that something "good" eventually happens, such as the gate eventually being raised after a long absence of trains. Progress properties are further classified into several distinct classes according to the formulas expressing them. Our verification methodology partitions the verification rules according to this classification, presenting rules for each class that are specific and effective for proving properties belonging to this class. The Three Volumes This book is the second in a sequence of three volumes (published by Springer­ Verlag) organized as follows: • Volume I (appeared in 1991): "The Temporal Logic of Reactive and Con­ current Systems: Specification." This volume studies in great detail the computational model, the system description language, the language of tem­ porallogic and its use for specifying system properties. We refer to Volume I as the SPEC book. • Volume II (This volume): "Temporal Verification of Reactive Systems: Safety." This volume presents verification techniques for proving safety prop­ erties. We refer to this volume as the SAFETY book. • Volume III: "Temporal Verification of Reactive Systems: Progress." This volume presents verification techniques for proving progress properties. We refer to Volume III as the PROGRESS book. Even though this is the second volume in the sequence, it is largely self-contained and can be studied or taught independently of the first volume. In particular, Chapter 0 includes all the material from the first volume that is relevant to tem­ poral verification. Naturally, most of the discussions and examples have been omitted, and we encourage the more inquisitive reader to consult the SPEC book whenever a more detailed explanation or motivation is needed. Verification Techniques As previously explained, this volume is devoted to the verification of safety prop­ erties. While all safety properties are specifiable by a formula of the form 0 p, it x Preface is possible to distinguish several subclasses of the safety class according to more specialized formulas expressing them. The main approach to verification studied in this volume (Chapters 1-4) is that of deductive verification: program properties are verified using formal deduction based on a set of inference rules. Such rules are presented first for some of the simpler subclasses, followed by rules for the entire safety class. A convenient and visual representation of the structure of a proof is provided by verification diagrams. Each set of rules, corresponding to a subclass or to the entire safety class, is shown to be complete for proving properties belonging to that class. This ensures that Every correct property of a system can be formally proven, using the deductive techniques presented in this book. In our presentation, we attempt to emphasize the feasibility, practicality, and universality of the deductive approach. In addition to the deductive approach, we also consider a second verification technique: algorithmic verification (often referred to as "model checking"). This technique is based on algorithms that, without any user guidance or ingenuity, check automatically whether a given system satisfies its temporal specification. The obvious advantages of this approach are offset by the fact that it usually can only be applied to finite-state systems, i.e., systems restricted to having only finitely many distinct states. In this volume we present several algorithms for checking that a given temporal formula is valid over a given finite-state system. In some cases these algorithms are also applicable to systems with infinitely many states. The presentation of algorithmic verification is also organized by subclasses of safety properties; we provide an algorithm for each

Load more

  16

Copy Link