|
|
| (One intermediate revision by one other user not shown) |
| Line 1: |
Line 1: |
| {{About|checking of models in computer science|the checking of models in statistics|regression model validation}}
| | Hi there! :) My name is Jesse, I'm a student studying Social Studies from Garfield Heights, United States.<br><br>Feel free to visit my page :: [http://intellitalent.com/perfect-your-strengths-and-find-you-brilliance/ FIFA coin generator] |
| {{Merge from|Temporal logic in finite-state verification|date=January 2011}}
| |
| {{Merge from|Fair computational tree logic|date=January 2011}}
| |
| In [[computer science]], '''model checking''' aka '''property checking''' refers to the following problem:
| |
| Given a model of a system, exhaustively and automatically check whether this model meets a given specification. Typically, one has hardware or software systems in mind, whereas the specification contains safety requirements such as the absence of [[deadlock]]s and similar critical states that can cause the system to [[Crash (computing)|crash]]. Model checking is a technique for automatically verifying correctness properties of ''finite-state'' systems.
| |
| | |
| In order to solve such a problem [[algorithm]]ically, both the model of the system and the specification are formulated in some precise mathematical language: To this end, it is formulated as a task in [[logic]], namely to
| |
| check whether a given [[structure (mathematical logic)|structure]] satisfies a given logical formula.
| |
| The concept is general and applies to all kinds of logics and suitable structures. A simple model-checking problem is verifying whether a given formula in the [[Propositional calculus|propositional logic]] is satisfied by a given structure.
| |
| | |
| == Overview ==
| |
| | |
| Property checking is used for [[Software verification|verification]] instead of [[equivalence checking]] when two descriptions are not functionally equivalent. Particularly, during [[Refinement_(computing)|refinement]], the specification is complemented with the details that are [[don't care|unnecessary]] in the higher level specification. Yet, there is no need to verify the newly introduced properties against the original specification. It is not even possible. Therefore, the strict bi-directional equivalence check is relaxed to one-way property checking. The implementation or design is regarded a model of the circuit whereas the specifications are properties that the model must satisfy.<ref>{{cite book |last= Lam K.|first=William |year=2005 |title=Hardware Design Verification: Simulation and Formal Method-Based Approaches |url=http://my.safaribooksonline.com/book/electrical-engineering/semiconductor-technology/0131433474/an-invitation-to-design-verification/ch01lev1sec1#X2ludGVybmFsX0h0bWxWaWV3P3htbGlkPTAxMzE0MzM0NzQlMkZjaDAxbGV2MXNlYzEmcXVlcnk9 |accessdate=December 12, 2012|chapter=Chapter 1.1: What Is Design Verification?}}</ref>
| |
| | |
| An important class of model checking methods have been developed for checking models of [[computer hardware|hardware]] and [[software]] designs
| |
| where the specification is given by a [[temporal logic]] formula.
| |
| Pioneering work in the model checking of temporal logic formulae was done by [[E. M. Clarke]] and [[E. A. Emerson]]<ref name=Allen1980>{{citation
| |
| | last1 = Allen Emerson | first1 = E.
| |
| | last2 = Clarke | first2 = Edmund M.
| |
| | year = 1980
| |
| | title = Characterizing correctness properties of parallel programs using fixpoints
| |
| | journal = Automata, Languages and Programming
| |
| | doi = 10.1007/3-540-10003-2_69
| |
| }}</ref><ref name="LoP81">Edmund M. Clarke, E. Allen Emerson: [http://portal.acm.org/citation.cfm?id=747438&dl= "Design and Synthesis of Synchronization Skeletons Using Branching-Time Temporal Logic"]. Logic of Programs 1981: 52-71.</ref><ref name=Clarke1986>{{citation
| |
| | last1 = Clarke | first1 = E. M.
| |
| | last2 = Emerson | first2 = E. A.
| |
| | last3 = Sistla | first3 = A. P.
| |
| | year = 1986
| |
| | title = Automatic verification of finite-state concurrent systems using temporal logic specifications
| |
| | journal = ACM Transactions on Programming Languages and Systems
| |
| | volume = 8
| |
| | pages = 244
| |
| | doi = 10.1145/5397.5399
| |
| | issue = 2
| |
| }}</ref> and by J. P. Queille and [[J. Sifakis]].<ref name=Queille1982>{{citation
| |
| | last1 = Queille | first1 = J. P.
| |
| | last2 = Sifakis | first2 = J.
| |
| | year = 1982
| |
| | title = Specification and verification of concurrent systems in CESAR
| |
| | journal = International Symposium on Programming
| |
| | doi = 10.1007/3-540-11494-7_22
| |
| }}</ref> Clarke, Emerson, and Sifakis shared the 2007 [[Turing Award]] for their work on model checking.<ref>[http://www.acm.org/press-room/news-releases/turing-award-07/ Press Release: ACM Turing Award Honors Founders of Automatic Verification Technology]</ref><ref>[http://usacm.acm.org/usacm/weblog/index.php?p=572 ''USACM'': 2007 Turing Award Winners Announced]</ref>
| |
| | |
| Model checking is most often applied to hardware designs. For software, because of undecidability (see [[Computability theory (computer science)|computability theory]]) the approach cannot be fully algorithmic; typically it may fail to prove or disprove a given property.
| |
| | |
| The structure is usually given as a source code description in an industrial [[hardware description language]] or a special-purpose language. Such a program corresponds to a [[finite state machine]] (FSM), i.e., a [[directed graph]] consisting of nodes (or [[vertex (graph theory)|vertices]]) and [[edge (graph theory)|edges]]. A set of atomic [[propositional calculus|proposition]]s is associated with each node, typically stating which memory elements are one. The [[Node (computer science)|nodes]] represent states of a system, the edges represent possible transitions which may alter the state, while the atomic propositions represent the basic properties that hold at a point of execution.
| |
| | |
| Formally, the problem can be stated as follows: given a desired property, expressed as a temporal logic formula ''p'', and a structure ''M'' with initial state ''s'', decide if <math>M,s \models p</math>. If M is finite, as it is in hardware, model checking reduces to a graph search.
| |
| | |
| == Algorithms ==
| |
| [[state space enumeration]], [[symbolic state space enumeration]], [[abstract interpretation]], [[symbolic simulation]], [[symbolic trajectory evaluation]], [[symbolic execution]]
| |
| | |
| === Explicit-state model checking ===
| |
| {{Expand section|date=January 2011}}
| |
| | |
| === Symbolic model checking ===
| |
| {{Expand section|date=January 2011}}
| |
| | |
| Instead of enumerating reachable states one at a time, the state space can sometimes be traversed much more efficiently by considering large numbers of states at a single step.
| |
| When such state space traversal is based on representations of states sets and transition relations as formulas, [[binary decision diagram]]s or other related data structures,
| |
| the model-checking method is symbolic.
| |
| | |
| Historically, the first symbolic methods used BDDs.
| |
| After the success of [[propositional satisfiability]] in solving the [[automated planning and scheduling|planning]] problem in [[artificial intelligence]] (see [[satplan]]) in 1996,
| |
| the same approach was generalized to model-checking for the [[Linear Temporal Logic]] LTL (the planning problem corresponds to model-checking for safety properties).
| |
| This method is known as [[bounded model-checking]].
| |
| | |
| == Tools ==
| |
| {{main|List of model checking tools}}
| |
| Model checking tools face a combinatorial blow up of the state-space, commonly known as the [[state explosion problem]], that must be addressed to solve most real-world problems. There are several approaches to combat this problem.
| |
| | |
| # Symbolic algorithms avoid ever building the graph for the FSM; instead, they represent the graph implicitly using a formula in quantified propositional logic. The use of [[binary decision diagram]]s (BDDs) was made popular by the work of Ken McMillan.<ref>* ''Symbolic Model Checking'', Kenneth L. McMillan, Kluwer, ISBN 0-7923-9380-5, [http://www.kenmcmil.com/thesis.html also online].</ref>
| |
| # Bounded model checking algorithms unroll the FSM for a fixed number of steps <math>k</math> and check whether a property violation can occur in <math>k</math> or fewer steps. This typically involves encoding the restricted model as an instance of [[Boolean satisfiability problem|SAT]]. The process can be repeated with larger and larger values of <math>k</math> until all possible violations have been ruled out (cf. [[Iterative deepening depth-first search]]).
| |
| # [[Partial order reduction]] can be used (on explicitly represented graphs) to reduce the number of independent interleavings of concurrent processes that need to be considered. The basic idea is that if it does not matter, for the kind of things one intends to prove, whether A or B is executed first, then it is a waste of time to consider both the AB and the BA interleavings.
| |
| # [[abstract interpretation|Abstraction]] attempts to prove properties on a system by first simplifying it. The simplified system usually does not satisfy exactly the same properties as the original one so that a process of refinement may be necessary. Generally, one requires the abstraction to be ''sound'' (the properties proved on the abstraction are true of the original system); however, most often, the abstraction is not ''complete'' (not all true properties of the original system are true of the abstraction). An example of abstraction is, on a program, to ignore the values of non boolean variables and to only consider boolean variables and the control flow of the program; such an abstraction, though it may appear coarse, may in fact be sufficient to prove e.g. properties of [[mutual exclusion]].
| |
| # Counterexample guided abstraction refinement (CEGAR) begins checking with a coarse (imprecise) abstraction and iteratively refines it. When a violation ([[counterexample]]) is found, the tool analyzes it for feasibility (i.e., is the violation genuine or the result of an incomplete abstraction?). If the violation is feasible, it is reported to the user; if it is not, the proof of infeasibility is used to refine the abstraction and checking begins again.<ref name=Clarke2000>{{citation
| |
| | last1 = Clarke | first1 = Edmund
| |
| | last2 = Grumberg | first2 = Orna
| |
| | last3 = Jha | first3 = Somesh
| |
| | last4 = Lu | first4 = Yuan
| |
| | last5 = Veith | first5 = Helmut
| |
| | year = 2000
| |
| | title = Counterexample-Guided Abstraction Refinement
| |
| | journal = Computer Aided Verification
| |
| | volume = 1855
| |
| | pages = 154
| |
| | doi = 10.1007/10722167_15
| |
| }}</ref>
| |
| | |
| Model checking tools were initially developed to reason about the logical correctness of [[Discrete system|discrete state]] systems, but have since been extended to deal with real-time and limited forms of [[hybrid system]]s.
| |
| <!--
| |
| This table (that was here) is unacceptable:
| |
| * It is containing hardly any Wikipedia related information
| |
| * The three links are now listed in the see also section
| |
| | |
| ==Some model checking tools==
| |
| {| border="1" cellpadding="1" class="wikitable sortable" style="width:100%"
| |
| !width="22%"|Tool
| |
| !width="15%"|Category
| |
| !width="15%"|Publisher(s)
| |
| !width="12%"|Specification Language
| |
| <sub>''(Logic used to specify the system and properties, etc.)''</sub>
| |
| !width="6%"|Antecendants
| |
| <sub>''(What the software is based on, other seminal products, etc.)''</sub>
| |
| !width="14%"|License
| |
| <sub>''(Type of license - e.g. GPL, closed source, commercial, etc)''</sub>
| |
| !width="14%"|Notes
| |
| <sub>''(Any notes on the software)''</sub>
| |
| !width="14%"|Link
| |
| |-
| |
| | Cadence - Incisive Formal Verifier
| |
| | Type
| |
| | Cadence
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://www.cadence.com/products/functional_ver/incisive_formal_verifier/index.aspx ]
| |
| |-
| |
| | [[SPIN model checker|SPIN]]
| |
| | Model checker for asynchronous process systems
| |
| | Bell Labs
| |
| | [[Linear Temporal Logic|LTL]]
| |
| |
| |
| |
| |
| |
| |
| | [http://spinroot.com]
| |
| |-
| |
| | KRONOS
| |
| | Timed model checker
| |
| | Verimag
| |
| | [[TCTL]]
| |
| |
| |
| | [[GPL]]
| |
| |
| |
| | [http://www-verimag.imag.fr/TEMPORISE/kronos/]
| |
| |-
| |
| | UPPAAL
| |
| | Timed model checker
| |
| | Uppsala University and Aalborg University
| |
| | Extended timed automata networks, subset of [[TCTL]]
| |
| |
| |
| | Free for research and education
| |
| | There are many extensions, e.g. for cost optimal scheduling and test generation
| |
| | [http://www.uppaal.com/]
| |
| |-
| |
| | ROMEO
| |
| | ROMEO model checker
| |
| | IRCCyN Lab
| |
| | Parametric Time and stopwatch Petri Nets, subset of [[TCTL]]
| |
| |
| |
| | Free for research and education
| |
| | [http://romeo.rts-software.org/]
| |
| |-
| |
| | 0-In Formal Verification
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://www.mentor.com/products/fv/abv/0-in_fv/index.cfm]
| |
| |-
| |
| | Alloy language
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://alloy.mit.edu/]
| |
| |-
| |
| | [[DiVinE model checker|DiVinE]]
| |
| | Parallel model checker for asynchronous process systems
| |
| | Masaryk University, Brno
| |
| | [[Linear Temporal Logic|LTL]]
| |
| |
| |
| | [[GPL]]
| |
| |
| |
| | [http://anna.fi.muni.cz/divine]
| |
| |-
| |
| | [[CHESS model checker|CHESS]]
| |
| | Preemption-bounded exploration of multithreaded programs
| |
| | Microsoft Research
| |
| |
| |
| |
| |
| |
| |
| | Binary release is available at http://research.microsoft.com/chess/
| |
| | [http://research.microsoft.com/chess/]
| |
| |-
| |
| | MoonWalker
| |
| | Software Model Checker for multithreaded .NET programs
| |
| | University of Twente
| |
| | Assertions and deadlocks
| |
| |
| |
| | Apache License 2.0
| |
| | Language-agnostic out of the box. Tested support for C#, untested support for J#, VB.NET and other .NET languages
| |
| | [http://www.cs.utwente.nl/~ruys/moonwalker/]
| |
| |-
| |
| | Synopsys - Magellan
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://www.synopsys.com/products/magellan/magellan.html]
| |
| |-
| |
| | APMC
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://apmc.berbiqui.org/]
| |
| |-
| |
| | AcPeg - Access Control Systems verification tool through Model Checking
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://www.cs.bham.ac.uk/~mdr/research/projects/05-AccessControl/index.html]
| |
| |-
| |
| | iLock - Formal Safety Verification of Rail Control Systems
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://www.prover.com/products/ilock]
| |
| |-
| |
| | [[BLAST model checker|BLAST]] - CEGAR-style model checker for C programs
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |-
| |
| | LoTREC
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://www.irit.fr/ACTIVITES/LILaC/Lotrec/modelchecking/index.htm]
| |
| |-
| |
| | Bogor
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://bogor.projects.cis.ksu.edu/]
| |
| |-
| |
| | [[BOOP Toolkit]]
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |-
| |
| | [[Cadena]]
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | [http://cadena.projects.cis.ksu.edu/]
| |
| |}
| |
| | |
| -->
| |
| | |
| ==See also==
| |
| * [[Binary decision diagram]]
| |
| * [[Büchi automaton]]
| |
| * [[Computation tree logic]]
| |
| * [[Formal verification]]
| |
| * [[Linear temporal logic]]
| |
| * [[Partial order reduction]]
| |
| | |
| ==Tools==
| |
| {{External links|section|date=December 2012}}
| |
| For a categorized list of tools see [[List of model checking tools|here]].
| |
| * [[Algebraic Petri Nets Analyzer|AlPiNA]],<ref>[http://alpina.unige.ch alpina.unige.ch]</ref> AlPiNA stands for Algebraic Petri Nets Analyzer and is a model checker for Algebraic Petri Nets.
| |
| * [[BLAST model checker|BLAST]]
| |
| * [[CADP]] (Construction and Analysis of Distributed Processes) a toolbox for the design of communication protocols and distributed systems
| |
| * [[CHESS model checker|CHESS]]
| |
| * [[CHIC (electronics)|CHIC]]
| |
| * [[CPAchecker]], an open-source software model checker for C programs, based on the CPA framework
| |
| * [[ECLAIR]], a platform for the automatic analysis, verification, testing and transformation of C and C++ programs
| |
| * [[FDR2]], a model checker for verifying real-time systems modeled and specified as [[Communicating sequential processes|CSP]] Processes
| |
| * [[ISP Formal Verification Tool|ISP]] code level verifier for [[Message Passing Interface|MPI]] programs
| |
| * [[Java Pathfinder]] - open source model checker for Java programs
| |
| * [[LTSmin]] - open source model checker for various specification languages ([[Promela]], [[mCRL2]], [[Uppaal Model Checker|UPPAAL]] language)
| |
| * [[Markov Reward Model Checker (MRMC)]]
| |
| * [http://babel.ls.fi.upm.es/~fred/McErlang/ McErlang], a model checker for Erlang programs which can be distributed and fault-tolerant.
| |
| * [[mCRL2]] Toolset, [[Boost Software License]], Based on [[Algebra of Communicating Processes|ACP]]
| |
| * [http://fmt.cs.utwente.nl/tools/moonwalker MoonWalker] - open source model checker for .NET programs
| |
| * [[NuSMV]], a new symbolic model checker
| |
| * [https://sourceforge.net/projects/redlib/ ompca], an interactive symbolic simulator with API control for C/C++ programs with OpenMP directives. The tool is built as an application of REDLIB.
| |
| * [[PAT (model checker)|PAT]] - an enhanced simulator, model checker and refinement checker for concurrent and real-time systems
| |
| * [[PRISM (model checker)|Prism]], a probabilistic symbolic model checker
| |
| * [[Rabbit Model Checker|Rabbit]], a model checker for timed and hybrid automata
| |
| * [https://sourceforge.net/projects/redlib/ REDLIB], library for the model-checking of communicating timed automatas with BDD-like diagrams. Applications include a TCTL model-checker with timed fairness quantifications, fair simulation checker, and interactive symbolic simulator for C/C++ programs with OpenMP directives. GUI for model editing and symbolic simulation are also available.
| |
| * [[Romeo Model Checker|Roméo]], an integrated tool environment for modeling, simulation and verification of real-time systems modeled as parametric, time and stopwatch Petri nets
| |
| * [http://www.cs.ucr.edu/~ciardo/SMART/ SMART Model checker], Symbolic Model checking Analyzer for Reliability and Timing
| |
| * [[SPIN model checker|SPIN]] a general tool for verifying the correctness of distributed software models in a rigorous and mostly automated fashion.
| |
| * [http://spot.lip6.fr/ Spot] a library to implement the automata-theoretic approach for model checking. Has good translation of [[Linear temporal logic|LTL]] into Büchi automata and also support the linear fragment of [[Property Specification Language|PSL]]. Must be interfaced with custom code that develop the state-space on-the-fly.
| |
| * [[TAPAs model checker|TAPAs]]: tool for the analysis of process algebra.
| |
| * [[TAPAAL Model Checker|TAPAAL]], an integrated tool environment for modeling, validation and verification of Timed-Arc [[Petri Nets]]
| |
| * [[TLA+]] model checker by [[Leslie Lamport]]
| |
| * [[Uppaal Model Checker|UPPAAL]], an integrated tool environment for modeling, validation and verification of real-time systems modeled as networks of timed automata
| |
| * [[Vereofy]],<ref>[http://www.vereofy.de Vereofy.de]</ref> a software model checker for component-based systems for operational correctness
| |
| * [http://homepages.cwi.nl/~mcrl/ μCRL], [[GNU General Public License|GPL]], Based on [[Algebra of Communicating Processes|ACP]]
| |
| | |
| ;Related techniques
| |
| *[[Abstract interpretation]]
| |
| *[[Automated theorem proving]]
| |
| *[[List of model checking tools|Model checking tools]]
| |
| *[[Program analysis (computer science)]]
| |
| *[[Static code analysis]]
| |
| | |
| ;History
| |
| * [[Edmund M. Clarke|E.M. Clarke]]: [http://www.springerlink.com/content/j335v4472745r366/ ''The birth of model checking'']
| |
| * [[E. Allen Emerson]]: [http://www.model.in.tum.de/um/25/pdf/Emerson.pdf ''The Beginning of Model Checking: A Personal Perspective''] (this is also a very good introduction and overview of model checking)
| |
| * [http://mrw.interscience.wiley.com/emrw/9780470050118/ecse/article/ecse247/current/abstract''Model Checking''], Doron Peled, Patrizio Pelliccione, Paola Spoletini, Wiley Encyclopedia of Computer Science and Engineering, 2009.
| |
| | |
| ==References==
| |
| | |
| {{Refimprove|date=November 2008}}
| |
| | |
| {{reflist}}
| |
| | |
| == Further reading ==
| |
| * [http://mrw.interscience.wiley.com/emrw/9780470050118/ecse/article/ecse247/current/abstract''Model Checking''], Doron Peled, Patrizio Pelliccione, Paola Spoletini, Wiley Encyclopedia of Computer Science and Engineering, 2009.
| |
| * ''Model Checking'', Edmund M. Clarke, Jr., [[Orna Grumberg]] and Doron A. Peled, [[MIT Press]], 1999, ISBN 0-262-03270-8.
| |
| * ''Systems and Software Verification: Model-Checking Techniques and Tools'', B. Berard, M. Bidoit, A. Finkel, F. Laroussinie, A. Petit, L. Petrucci, P. Schnoebelen, ISBN 3-540-41523-8
| |
| * ''Logic in Computer Science: Modelling and Reasoning About Systems'', Michael Huth and Mark Ryan, [[Cambridge University Press]], 2004. [http://dx.doi.org/10.2277/052154310X DOI DOI/org].
| |
| * [http://spinroot.com/spin/Doc/Book_extras/ ''The Spin Model Checker: Primer and Reference Manual''], [[Gerard J. Holzmann]], Addison-Wesley, ISBN 0-321-22862-6.
| |
| * Julian Bradfield and Colin Stirling, Modal logics and mu-calculi, [http://homepages.inf.ed.ac.uk/jcb/Research/bradfield-stirling-HPA-mu-intro.ps.gz Inf.ed.ac.uk]
| |
| * Specification Patterns [http://patterns.projects.cis.ksu.edu/documentation/patterns.shtml KSU.edu]
| |
| * Property Pattern Mappings for RAFMC [http://cadp.inria.fr/resources/evaluator/rafmc.html Inria.fr]
| |
| * Radu Mateescu and Mihaela Sighireanu [http://vasy.inria.fr/publications/Mateescu-Sighireanu-03.html Efficient On-the-Fly Model-Checking for Regular Alternation-Free Mu-Calculus], page 6, Science of Computer Programming 46(3):255-281, 2003
| |
| * Müller-Olm, M., Schmidt, D.A. and [[Bernhard Steffen (computer scientist)|Steffen, B.]] [http://people.cis.ksu.edu/~schmidt/papers/sas99.ps.gz ''Model checking: a tutorial introduction.''] Proc. 6th Static Analysis Symposium, G. File and A. Cortesi, eds., Springer LNCS 1694, 1999, pp. 330–354.
| |
| * Baier, C., Katoen, J.: Principles of Model Checking. 2008.
| |
| {{FOLDOC}}
| |
| | |
| {{DEFAULTSORT:Model Checking}}
| |
| [[Category:Model checking| ]]
| |