ebook img

Formal verification of timed systems: a survey and perspective PDF

23 Pages·2004·0.593 MB·English
by  Wang F.
Save to my drive
Quick download
Download
Most books are stored in the elastic cloud where traffic is expensive. For this reason, we have a limit on daily download.

Preview Formal verification of timed systems: a survey and perspective

Formal Verification of Timed Systems: A Survey and Perspective FARN WANG Invited Paper An overview of the current state of the art of formal verifica- • Withthereadinessofconcretetheoreticalframeworks tion of real-time systems is presented. We discuss commonly ac- fortheverificationofreal-timesystems[5],[11],[113], cepted models, specification languages, verification frameworks, [127]–[129],[133],[197],bothprogrammersandthe- state-spacerepresentation schemes,state-spaceconstructionpro- oreticians are eager to see how the theory adapts to cedures, reduction techniques, pioneering tools, and finally some newrelatedissues.Wealsomakeafewcommentsaccordingtoour real-worldprojects. experiencewithverificationtooldesignandimplementation. • Withtheincreasingscopeandcomplexityofembedded systems and resulting state-space explosion, it is be- Keywords—Embedded systems, formal methods, formal verifi- cation, models, real-time systems, specification, temporal logics, cominglessandlesslikelythatwecanrunasufficient theory,tools. numberofsimulationtracestogainbothenoughcov- erageofthestatespacesandenoughconfidenceinthe systemswithaprojectschedule.Further,evenifitwere I. INTRODUCTION feasibletohaveextensivecoverageofthe system,the Real-time systems differ from untimed systems in that potentialofasingleuntestedsequenceofeventsthatno theirbehavioralcorrectnessreliesnotonlyontheresultsof one thought of to cause system failure is also of con- their computations, but also on the clock times when the cern. results are produced. Formal verification means to rigor- In the last two decades, many achievements in the formal ously explore the correctness of system designs expressed verification of real-time systems have been reported, from as mathematical models, most likely with the assistance of various solid theory foundations to complex implementa- modern computers. From our viewpoint, there have been tion techniques and formal verification of many real-world the following three motivations for the heated research on projects [37], [189], [203], [206]. Still the intrinsic com- the formal verification of real-time systems in the last two plexity of various framework for real-time system verifica- decades. tionisforbiddinglyhigh.Theverificationproblemsoftimed • Withthesuccessofformalverificationintheverylarge systems are usually exponentially more complex than their scale integration (VLSI) industry [53], it is natural to untimed counterparts. For example, the model-checking expect that similar success can be repeated in the problemofcomputationtreelogic(CTL)isinPTIME1[60], formal verificationofreal-time systems.In particular, [61], while that of timed CTL (TCTL) is in PSPACE2 [5]. the achievement of binary decision diagram (BDD) Thus, in the foreseeable future, it will be difficult to use technology[52]hasraisedthehopesandconfidenceof formal techniques alone for decisive answers to complex theindustryfortheverificationofreal-timesystems. verificationtasks. Butthisdoesnotmeanthatwearepessimisticaboutthefu- tureofformalverification.Onthecontrary,withmostmajor projects currently spending over 50% of their development Manuscript received November 15, 2003; revised April 19, 2004. costsinverificationandintegration,therearetremendousop- ThisworkwassupportedinpartbytheNationalScienceCouncil(NSC) portunitiesforusingformalverificationtosizablyreducethe of Taiwan, R.O.C., under Grants NSC 92-2213-E-002-103 and NSC 92-2213-E-002-104, and in part by the System Verification Technology ProjectoftheIndustrialTechnologyResearchInstitute,Taiwan,R.O.C. The author is with the Department of Electrical Engineering, 1PTIMEproblemscanbesolvedwithtimecomplexitypolynomialstothe National Taiwan University, Taipei 106, Taiwan, R.O.C. (e-mail: inputsizesinbitcounts. [email protected]). 2PSPACEproblemsmayincurmemoryconsumptionpolynomialstothe DigitalObjectIdentifier10.1109/JPROC.2004.831197 inputsizesinbitcounts. 0018-9219/04$20.00©2004IEEE PROCEEDINGSOFTHEIEEE,VOL.92,NO.8,AUGUST2004 1283 explosivegrowthofverificationandintegrationcostsandto Beforeyougoon,weremindyouthatthepapermayshow enhancethequalityofsystemdesignsinindustry.Ontheone theauthor’sintentionalorunconsciousbiastowardeachap- hand,forcomplexreal-timesystems,formalverificationwill proachinformalverification.Afterall,theamountofspace likely be used to enhance the intelligence and performance neededtoexplainthedetailsofeachsubfieldisasubjective ofsimulationandtesting.Forexample,coveragemetricscan decision. bemorepreciselymappedtothefunctionstobeverified.On the other hand, for targets with clean modularity and inter- II. MODELS face,formalverificationcanbeusedtorigorouslycheckthe Formal verification grows from formal or mathematical components and the interfaces and gradually could be ac- logics [41], in which we discuss the grammar (syntax) and cepted as standard methods in the automation of industrial meaning (semantics) of logic formulas. It is possible to as- qualitycontrol.Actuallyitisclaimedthatthislatterapproach sociatethesamegrammarwithdifferentstylesofmeaning. has already had a dramatic effect on the SLAM project of Themeaningofalogicformulaisdefinedasasetofmodels. Microsoft,whichplanstoincorporatemodel-checkingcapa- A model in mathematical logic is a domain of values and bilityinitsWindowsdriverdevelopmentkit(DDK)[34]. somefunctionsonthedomain.Withoutsuchformaldefini- In this paper, we give a review of these many achieve- tions,rigorousandmechanicalverificationofreal-timesys- ments so that readers can use the paper as an index to the temswillbeimpossible. literature.Weorganizethepaperaccordingtothevariousre- Intuitively,intheforumofspecificationandverification,a searchtopicsinformalverification,includingmodelsinSec- modelisabehaviorofasystemdescription(orspecification). tionII,descriptionandspecificationlanguagesinSectionIII, Accordingtothevariousframeworksweuse,amodelfora verificationframeworksinSectionIV,representationofstate real-timesystemcanbeastateset,astatesequence,anevent space in Section V, constructions of state-space representa- sequence, a state tree, or an infinite domain with relations. tionsinSectionVI,reductiontechniquesforrepresentations Someotherpossibilitiescanalsobefoundin[80]. in Section VII, some tools in Section VIII, and some other issues in Section IX, including symbolic simulation, para- A. LinearTimeVersusBranchingTime metric analysis, controller synthesis, probabilistic analysis, andworstcaseexecutiontime(WCET)analysis. We can view a computation either as a linear sequence Therearemanyframeworkstochoosefromtocompletea withonlyonefutureorasatreewithmanypossiblefutures. verification task. Each framework has its unique advantage The former is calledlinear-time semantics [185],while the and may incur an intrinsic challenge. We feel it is better to latteriscalledbranching-timesemantics[60],[61]. let the readers be informed of the challenges in the verifi- Linear-Time Temporal Logics: The research on auto- cation frameworks of his/her choice. Thus we have cited maticverificationofcomputerprogramswasinitiatedwhen manycomplexityresultsofvariousverificationproblemsin Pnueli proposed using linear-time propositional temporal the paper. Complexity of a verification problem means the logic(LPTL)[185]tospecifyandcomputethebehaviorsof order of growth of required resources to solve the problem computer systems. LPTL is a subclass of modal logic [41] with respect to the input sizes in bit counts. The resources withpossible-worldsemanticsandmodaloperators: (for can be CPU times, memory space, message counts, power allpossibleworlds)and (thereexistsapossibleworld).In consumption,etc.Butinthispaper,wearemainlyconcerned LPTL, is interpreted as “from now on, at all states” (or withCPUtimesandmemoryspace.Somejargonofthecom- henceforth,always),while isinterpretedas“fromnowon, plexity classes includes PTIME, NP-complete,3 PSPACE, there exists a state” (or eventually). For example, we may EXPTIME,4EXPSPACE,5nonelementarycomplexities,6and havethemodelofarailroadcrossingsystem. undecidability.7 and are two atomic propositions, and we want to HeitmeyerandMandriolihavealsowrittenahandbookon specifythatwheneveranapproachingtrainisdetected,from formalverificationtechniquesforreal-timecomputing[106]. thatstateon,eventuallythegateisdown.InLPTL,thiscan Regardingtechniquesforuntimedsystems,aclassicbookis beexpressedas one by Clarke et al. [65]. A previous survey paper in this regardisbyOstroff[179]. 3NPproblemsmeansthatwe canguessasolutionintimecomplexity Twoothercommonlyusedmodaloperatorsare (next)and polynomialstotheinputsizes.NP-completeproblemsarethehardestonesin NPandareingeneralconsidereduntamableproblemsincomputersciences. (until). means that is true in the next state. 4EXPTIMEproblemsconsumeCPUtimesexponentialtothesizesofin- meansthat istrueuntil istrue. putsinbitcounts. Indefininglogics,peopleusuallytrytouseminimalsyntax 5EXPSPACEisthesetofproblemsthatatmostconsumememoryca- structures. Usually and can be defined as the short- pacityexponentialtotheinputsizesinbitcounts.EXPSPACE-complete problemsareharderthanEXPTIMEproblems. handsfortrue and ,respectively.Ontheotherhand, .. Kampshowedthat cannotbemodeledwithmodalop- . 6Nonelementarycomplexitiesarelike2 withtheheightsoftheexponent erators , ,and [131]. stacksatleastproportionaltotheinputsizesinbitcounts. Inthelate1980s,peopleaddedtheconceptof“clocktime” 7Undecidableproblemsdonotguaranteetermination.Ingeneral,itisnot toLPTL.Thatis,aglobalclockisassumedinthemodelsuch possibletodesignalgorithms(proceduresthatguaranteetermination)for undecidableproblems. thattheglobalclockdoesnothavetoincrementitsreading 1284 PROCEEDINGSOFTHEIEEE,VOL.92,NO.8,AUGUST2004 ateverystate.Initially,Ostroff[178]discussedissuesinex- pressiveness and complexity with quantification and linear constraintsofclockreadingsinLPTL.Forexample,wemay write (1) Here is the special variable for the reading of the global Fig.1. TwobehaviorsthatCTLcandifferentiate. clockatthecurrentstate. Alur and Henzinger proposed timed propositional tem- porallogic(TPTL)[15].TPTLhasaclock-readingfreezing ( , ).IntheliteratureofCTL,modaloperators , , , , modal operator and uses binary difference constraints be- ,and arewrittenas , , , , ,and ,respectively. tween frozen clock readings. The intuition is that quantifi- Insemantics,anLPTLformuladefinesasetoflinearstate cations on clock readings following are universal, while sequences,whileaCTLformuladefinesasetofcomputation the ones following are existential. For example, we may trees.CTLandLPTLarenotcomparableinexpressiveness. write For example, the LPTL formula says states happen infinitelymanytimes.Also,thenonZenorequirement[113] (2) in TPTL is . These properties are known to be inexpressible in the timed extensions of CTL. On the other which means that the gate will be down in 300 s from any hand, CTL allows for the reasoning of properties between stateinmode .Notethatthisformulaspecifies possiblefuturebehaviors.Forexample,theCTLformula somethingdifferentfrom(1).In(1),time isindependentof thestatesquantifiedbythemodaloperator ,whilein(2),it is not. Alur and Henzinger also defined metric temporal logic candifferentiatethetwobehaviorsinFig.1,whilenoLPTL (MTL),whichallowsthespecificationoftimingdistancesbe- formula can. tweenstatesquantifiedbyadjacentmodaloperators[16].For Emerson et al. proposed real-time CTL (RTCTL) [83], example,wemaywrite whichusesformulaslike tospecifytheexistence of a state sequence along which becomes true within the next states.Thistypeofpropertyissuitableforcycle-based systems like VLSI, in which the discrete global clock ticks to specify the same property as (2). A nice exploration of ateverydiscretestatechange[83]. variousdiscrete-timeextensionsofLPTLis[16]. Harel et al.[104] discussed the expressivenessand com- In 1992, Wang et al. extended TPTL to Asynchronous plexity of the CTL extension with universally quantified PTL(APTL)fordistributedsystemswithclockjitters[228]. clockvariablesandarbitrarylinearclockconstraints. Specifically,theyredefinethesemanticsofclockdifferences Themostusedbranching-timetemporallogicforreal-time in distributed systems with a timing precedence relation. systems is TCTL [5], which supports modal operators like The idea is that instead of comparing the values of clock , , , , ,and .Here isanat- readings,wenowcomparethetemporalprecedenceofclock uralnumberand isoneof , , , ,or .Forexample readings.Forexample,wemaywrite , which means that we have two distributed clocks such that at every state, if the reading of the two clocks are and , respectively, then every second tick of the first clock must meansthatwheneverthemonitorisinmode , precedethenexttickofthesecondclock.Puttingitanother alongallrunshenceforth,thegatewillbeclosedin300s. way,foreverytickofclock2,clock1willtickatleasttwice. Besideitsmodality,TCTLalsodiffersfromTPTLandthe Branching-Time Temporal Logics: The intuition behind likeinthatTCTLisdefinedwithdense-timeclockmodels. linear-time logics is that there is only one future. With Thus,thereisnomodaloperatorinvolving . branching-time logics, the possibility of many futures is IntegrationofLinearTimeandBranchingTime: Emerson assumed, and modal operators , are provided to specify andHalperndefinedaunifiedspecificationlanguage,called therelationamongdifferentfutures.Pathquantifier means ,forbothLPTLandCTL[81].RememberthatinCTL, “there exists a run from now on” and means that “for all we require that linear-time modal operators must immedi- runsfromnowon.”Forexample,inCTL[60],[61] ately follow path quantifiers. If this restriction is lifted in CTL,thenwegetCTL .RegardingLPTL,eachLPTLfor- mulaspecifiesthesetoflinearsequencessatisfyingit.Thus, meansthatwheneverthemonitorisinmode , intuitively,LPTLisasubclassofCTL becauseeveryLPTL alongallrunshenceforth,thegatewilleventuallybeclosed. formulaimplicitlycarriesauniversalquantifieronallcom- NotethatinCTLanditsextensions,linear-timemodaloper- putationsequences.Thatis,anLPTLformula characterizes ators( , , , )mustimmediatelyfollowapathquantifier thesamesetofstatesequencesastheCTL formula . WANG:FORMALVERIFICATIONOFTIMEDSYSTEMS:ASURVEYANDPERSPECTIVE 1285 It is also natural to extend CTL to TCTL . Möller dis- able gate can be used for the gate position of the present cussedhowtomodelcheckasubclassofTCTL [167].Wang state. State-based real-time temporal logics are usually de- carriedoutexperimentsusingmodel-checkingalgorithmson rivedfromtheiruntimedcounterparts[60],[61],[185].Ex- thesubclassofTCTL whichcontainsfairnessassumptions amples include TCTL [5], RTCTL [83], TPTL, MTL [16], [220]. andAPTL[228]. An event represents an instantaneous change of states B. DiscreteTimeVersusDenseTime and may trigger a series of responses in a system. For In the definition of real-time system models, we can example,thedetectionofanapproachingtrainatarailroad requirethatalltime readingsare integers and allclocksin- crossing is an event that will hopefully cause the gate to crementtheirreadingsatthesametime.Thisisdiscrete-time close. Event-driven system descriptions are very natural in semantics [15], [127]. The other choice is dense-time se- theworldofembeddedsystemengineering.Onepioneering mantics [11], [78], which means that time readings can be work that incorporates timed events into the linear-time rationalsorrealsandallclocksincrementtheirreadingsata modelisreal-timelogic(RTL)byJahanianandMok[127]. uniformrate. RTL is a linear-time event-driven logic with event occur- Discrete-time models are suitable for synchronous sys- rence-timefunctions.Forexample,wemaywrite tems where all concurrent processes share the same global clock.ExamplelanguagesareTPTLandMTL[16].Dense- timemodelsarebetterfordistributedsystemswithmultiple whichmeansthatafterthe thtrain eventhas clocks and timers, which can be tested, set, and reset inde- occurred,the thgate eventmusthappenin300s.RTL pendently.ExamplesincludeTCTL[5]. is a subclass of first-order integer arithmetic with monadic Note that inour explanation of discrete-time models, we functions. Yang et al. [233] have also designed a temporal require that there is a single global clock. It may seem that logic, synchronous real-time event logic (SREL), based on such a requirement is inappropriate for distributed systems event countings along state sequences in a discrete-time withdigitalclocks.Infact,afterthesamplingordetectionof domain. aneventinanembeddedsystem,theoccurrencetimeofthe Onethingtonoteisthatinsynchronouscycle-basedsys- eventisstillstoredinadigitalformat.Thus,philosophically, tems,e.g.,VLSIcircuits,peopleusuallytreatstateandevent discrete-timesemanticswithdistributedclocksseemsaplau- asthesamething,sincevariableschangevaluesonlyatthe siblechoice.Butingeneral,iftheclocksaredistributedand beginningofeachclockcycleandthenremainsteadyinthe donotincrementtheirreadingsatthesametime,thenwestill cycle. But for distributed real-time systems, this treatment have to implicitly record the ticking order of the clocks so may leadtoimprecise modeling,sincethere isnocommon thattheclocksstillincrementtheirreadingsatthesamerate. clockamongthemanydistributedsites. Theinformationpiecesoftickingordersareoffactorialcom- Italsohaslongbeenarguedthatneitherpurestate-based plexity,whichisthesameasthatofregiongraphconstruction nor pure event-based languages quite support the natural fordense-timemodels[5],anddonotsaveanycomputation expressiveness desirable for the specification of real-world resources. Henzinger et al. discussed the relation between systems [57], [122], [134], [137], [174]. Recently, Wang systems with distributed digital clocks and those with dis- has proposed an extension to TCTL for the specification tributeddenseclocks[112]. and model checking of behaviors involving both states and Clock-readingmodelscanalsoaffecttheverificationcom- eventswithfairnessassumptions[220].Forexample,inthe plexity.Forexample,thesatisfiabilityproblemofTPTLisin railroad crossing system, we may want to say that when EXPSPACE,whileitsdense-timeversionisundecidable.In- the monitor signals the controller to the gate, then tuitively,discrete-timemodelsmayleadtolowercomplexity the gate must be in 300 s. This can be specified as inverificationandanalysis,sincetherearemanyfewerstates. lower . Here means that whenever But in practice, the impact on complexity is tricky. Specif- eventsoftype happen, mustimmediatelybetrue. ically, with the symbolic techniques for timed and hybrid systems[18],[113],statespacesarerepresentedasBoolean III. DESCRIPTIONANDSPECIFICATIONLANGUAGES combinationsoflinearconstraintsofstatevariables.Anim- A. TimedAutomata portant operation is checking the emptiness of state-space representations. However, the emptiness problem of linear ThemodeloftimedautomatawasfirstproposedbyAlur constraintsisinPTIMEforreals(indense-timemodels)and andDill[11].Atimedautomatonisafinite-stateautomaton NP-completeforintegers(indiscrete-timemodels). equipped with a finite set of clocks which can hold non- negative real values. It is structured as a directed graph C. StateBasedVersusEventDriven whose nodes are modes (control locations) and whose arcs Astateisasnapshotofasystematamomentintime.In aretransitions.Theexampleofamonitorprocessfortrains the sense of control, it is everything that we need to know approachingarailroadcrossingisinFig.2.Themonitorisin about the system at that moment in order to determine the modefarwhenalltrainsarefarfromthecrossing,orinmode futureforallfutureinputsequences.Mathematically,itcon- approaching when a train will arrive at the crossing within sistsoftherecordingofthevaluesofallvariablesandcon- 300s,orinmodecrossingwhenatrainisatthecrossing,or trol locations. For instance, at a railroad crossing, the vari- inmodepassedwhentrainshavejustleftthecrossingwithin 1286 PROCEEDINGSOFTHEIEEE,VOL.92,NO.8,AUGUST2004 Fig.2. Themodelofgate–monitor. the last 100 s. The ovals represent modes, while the arcs representtransitions.Themodesarelabeledinsidetheovals withinvarianceconditionswhichareBooleanconjunctions. All states in a mode must satisfy the corresponding invari- ance condition. At any moment, the timed automaton can reside in only one mode. The transitions are labeled with Fig.3. Themodelofgate–monitor–controller. triggering conditions and a set of clocks to be reset during the transitions. A timed automaton can make a transition undercertainconditions,symbolicmanipulationtechniques only if it satisfies the corresponding triggering condition. for timed automata have performed well enough to verify The invariance conditions and triggering conditions are manyindustrialsystems[113]. Boolean combinations of clock (difference) inequalities. In a timed automaton’s operation, one of the transitions can B. CommunicatingTimedAutomata be triggered when the corresponding triggering condition is satisfied. Upon being triggered, the automaton instanta- Complexstatetransitionsmayrequirecooperationamong neously transits from one mode to another and resets some processestoconstruct.Forexample,intherailroadcrossing clocks to zero. In between transitions, all clocks increase example,atthetimewhenanapproachingtrainisdetected, theirreadingsatauniformrate. the monitor sends a “signal” to the gate controller to move Astateofatimedautomatonisarecordingofitspresent thegatedown.Conceptuallywecandecomposethesystem mode and the readings of all clocks. With discrete-time intotwoprocesses:thetrainmonitorandthegatecontroller. models,allclockswillhaveintegerreadingsandincrement The sending and receiving of the signal can best naturally theirreadingsat thesameinstant.Withdense-timemodels, be modeled bythe interaction betweenthe monitor and the clock readings are reals (or rationals). A computation of controller.Therearealsotwoprocesstransitionsinvolvedin a timed automaton can be defined as an infinite sequence thebehavior,i.e.,thedetectionoftheapproachingtrainand of time-state pairs such that the time components form a thestartingofthegate’smovingdown. nondecreasinganddivergentrealnumbersequence. Thefirstlanguagedevicedesignedto“glue”processtran- A timed automaton is a nondeterministic machine and sitions into a (global) transition is the channel concept for does not have to make transitions as long as the invariance binary synchronizationinHoare’s Communicating Sequen- condition is satisfied. One usual way to force transitions is tialProcesses(CSP)[115].Suchadevicecangreatlyhelpto byusinganinvariancecondition.Forexample,inFig.2,in improvethemodularityofmodeldescriptions.Forexample, the “approaching” mode, we require that to force in the embedded control system for a railroad crossing, we thetransitionoutofthemodein300timeunits. mayhaveachannelcalled forthecommunicationof Inpractice,areal-timesystemisusuallydescribedasaset the command to move the gate down. The language device of process timed automata, each representing the behavior representsthesending(oroutput)eventthroughthe ofanautonomousprocess.Suchadecompositionisnatural channel, while represents the receiving (or input) in the description and construction of concurrent and dis- event through the same channel. Two process transitions tributed systems. By decomposing a timed automaton to a labeled, respectively, with the sending event and receiving setofprocessautomata,engineerscangreatlysimplifytheir event through the same channel must happen at the same tasks in the modeling of complex, concurrent behaviors. instant to make a legitimate global transition. The inter- The timed automaton can be constructed as the product active synchronization between a train monitor and a gate automaton of the process timed automata. The mode set of controller can be modeled with the communicating timed the product automaton is now the Cartesian product of the automaton in Fig. 3. When the monitor detects that a train mode sets of the process timed automata. The invariance is approaching the railroad crossing, it sends out a signal condition is defined by the conjunction of the invariance through channel to the controller to move the gate conditionsofthemodesoftheprocesstimedautomata.The down. A process transition with an input event that cannot behavior of the product timed automaton is an interleaving find a peer process transition with matching output event oftransitionsoftheprocesstimedautomata. simplycannotbeexecuted. What makes timed automata interesting is that their CSP-stylesynchronizationchannelswereincorporatedin model-checking problem is in PSPACE [5]. Moreover, communicating real-time state machines (CRSM) [198] in WANG:FORMALVERIFICATIONOFTIMEDSYSTEMS:ASURVEYANDPERSPECTIVE 1287 1992. Such devices are now supported in real-time system To know when to stop inferencing in case the specifica- model-checkers like I/O automata [90], [133], [157], UP- tion formula is actually not a theorem, we need to prove a PAAL[39],[183],SGM[120],[222],[223],andtheregion- small model theorem to establish the maximum number of encodingdiagram(RED)[213],[216],[217],[219]. inferencestepsfortheproofofthespecificationformula.The A similar synchronization device is used inHyTech [18] complexityoftheverificationproceduredependsonthecom- andKronos[75],[237]withnodistinctionbetweensenders plexityofthesmallmodels. and receivers.Each process is declaredwith the setof syn- Propositional temporal logics, linear time and branching chronizerstorespondto.Thenwhenasynchronizerhappens, time,havebeendiscussedinSectionII-A.Theadvantageof all processes declared to respond to it will have to make a suchframeworksisthattheyusuallycomewithsmallmodel processtransition.Suchadeviceishandyinmodelingbroad- theoremsandalgorithmstocheckwhetheraformulaisathe- casting,multicasting,andothermultipartysynchronizations. orem or not. The disadvantage is that they are usually not For example, to model the bus collision behavior in carrier expressiveenoughtomodelcomplexbehaviorswith,forin- sense multiple access with collision detection (CSMA/CD) stance,queues,stacks,counters,range-unboundedvariables, protocol[175],thebusprocessmayexecuteatransitionla- polynomialconstraints,etc. beledwiththeeventCollision_Detected,whichwill First-order and higher order logics have also been used forceeverysenderprocesstorespondtoatransitionwiththe [127], [197] for specification and verification. The advan- sameevent.ItisalsopossibletocombinebasicCSP-stylebi- tageisthatsuchlogicsareveryexpressiveformodelingcom- narysynchronizationstoconstructsuchcomplexmultiparty plexbehaviors.Thedisadvantageisthatingeneral,itisnot synchronizations.Forexample,inRED[219],tomodelthe possibletodesignalgorithmstocheckwhetheraformulais bus collisioneventinCSMAwith senders,thebus a theorem or not.8 First-order logics seem a good compro- needs to execute a transition with !Collision_De- mise between expressiveness and computability, since they tected labels, and, thus, forces each of the senders to are complete ingeneral.Thatis,we stillhavesemidecision respectively respond with a transition with one ?Colli- proceduresthatareguaranteedtoconstructproofsifthespec- sion_Detectedlabel. ificationformulasareindeedtheorems. On the other hand, higher order logics [96], [181] are in C. HybridAutomata generalincomplete.Interestedreadersarereferedto[176]for Hybridautomata[18],[108]areusedtomodelembedded atutorialonIsabelle/HOL.MattoliniandNesipresentedtem- systemswithcontinuousvariables,whosevaluesmayincre- poral-interval logic with compositional operators (TILCO) ment/decrementatvariousrates.Arbitrarylinearconstraints [161]withformalproofsupportfromIsabelle/HOL. are allowed for invariance conditions and triggering condi- tions.Timedautomata[11]area specialsubclassofhybrid E. TimedProcessAlgebras automata in which all continuous variables increment their TimedCSPwasfirstdesignedbyReedandRoscoe[188] values at a uniform rate and only upper-bound and lower- andlatermodifiedbyDaviesandSchneider[74].Itsupports boundinequalitiesofclocksareallowed.Ahybridautomaton thefollowingthreegrammarruleswithtimingconstraints: shares the same structure as timed automata, except that in eachmode,theincrementrateofeachcontinuousvariableis Wait independentlyspecified. Ingeneral,hybridautomataarenotsubjecttoalgorithmic “Wait ”meanstowaitfor timeunits. verification,buttherearesubclasseswhichare[109]. modelsthetimeoutincommunication.Itbehaves as until,attime ,whennosynchronizationhashappened D. Logics yet,thecontrolistransferedto . Logic formulas can also be used to describe system behavior. In such frameworks, the system descriptions (in- models the interrupt in embedded systems. It cluding the models for systems and environments) and the behavesas untilattime ,regardlessofsynchronizations, specifications are all put down in the same language. In whencontrolistransferedto . its operation, a logic theory is defined by a set of axioms The timevalue domainintimed CSPis dense. A variety and inference rules. Every formula that can be constructed ofsemanticshasbeendefined.Thesimplestoneassociatesa throughrepetitiveapplicationsoftheinferencerulesiscalled programwithasetoftimedtraces.Schneiderwroteabook atheorem.Twokeyissuesaresoundnessandcompleteness. in this regard [194]. In the book, manual proofs are illus- Soundness means that the theorems in the theory are con- tratedandarefinementrelationfromuntimedCSPprograms sistent, i.e., do not contradict one another. Completeness totimedCSPprogramsispresented.Withtheintroductionof means that every theorem can be provedin a finite number theeventtock,whichadvancestimebyoneunit,Schneider ofstepsofinferenceruleapplications.Whenwe uselogics alsoshowedhowtotranslatetimedCSPprogramstountimed forverification,weusuallyputdownthesystemdescription CSPprogramswithtockevents. asaxiomsandinferencerulesandthespecificationformulas Baetenetal.havedonesubstantialworkinextendingthe asatheorem.Aproofplanmayalsoinvolveseverallemmas process algebra known as the algebra of communicating andcorollariesasintermediatestepstotheestablishmentof 8Inthejargonofcomputerscience,thedecisionproblemsofsuchlogics thegoaltheorem. aresaidtobeundecidableorincomputable. 1288 PROCEEDINGSOFTHEIEEE,VOL.92,NO.8,AUGUST2004 processes (ACP) to the real-time domain [30]–[32]. The axioms which must be satisfied in each action to maintain time models can be dense or discrete. Both absolute time thenaturalconceptsoftimestamps. and relative times can be specified. Time-stamped actions AdbullaandNylendefinedtimedPetrinets[3],inwhich can be used to combine actions with the passage of time. each token is associated with a clock which can be reset at Theintegrationoperator allowscompositionovera thetimeoftransition.Thisresemblestheclockresetopera- continuum of alternatives. The initial abstraction operator tionsoftimedautomata.Thereisalsonoobligationtofirean definesamappingfromaparametricinitialsetting enabledtransitionbeforetheLftexpires. of real variable to a set of processes, whose behaviors Serugendo et al. extended Merlin and Faber’s time Petri dependonthevalueof . net to real-time synchronized Petri nets with synchroniza- Work on the calculus of communicating systems (CCS) tionsbetweenasetofobjects,modeledwithreal-timePetri withtimingcanbefoundin[59],[170],and[234]. nets [195]. Another timed extension of process algebra is PACSR Girault and Valk editted a handbook on formal methods [152],[184],whichsupportsresource-awarenessandproba- based on Petri nets [94]. Cerone and Maggiolo-Schettini bilityreasoninginembeddedsystemdesign. wrote a survey paper on various approaches to extending LOTOS is an ISO standard specification language based Petri netstospecification andverificationoftimed systems on process algebra [43], [123]. Its real-time extension is [56]. called Enhanced Timed-LOTOS (ET-LOTOS) [124], [150], [151]. G. GraphicalLanguages Statecharts [103] were introduced to help users describe F. TimedPetriNets behavioral hierarchies of untimed concurrent systems in a graphicalstyle.Systemoperationscanbehierarchicallyde- Petri nets [87], [130] are convenient for modeling con- composedtoparalleland serialmodes.Suchbehavioralhi- current systems. In a Petri net, we have places, which may erarchy has inspired various compositional frameworks for hold tokens, and transitions, which may consume some to- verification and analysis, e.g., assume–guarantee reasoning kensfromtheplacesandproducesomeothertokensinother [1],[17],[99],[162],[205],andstaterefinementverification places.A state ofa Petrinet is called amarking, which as- [9], [232]. signs a number of tokens to each place. Since each place Modecharts[128]werethefirsttimedextensionofstate- canholdanunboundednumberoftokens,Petrinetsareinfi- charts.Their semantics was definedwith RTL[127] indis- nite-statesystems.OnespecialthingaboutPetrinetsisthat cretetime-domain.Timingintervalsanddiscreteeventscan they lack the capability to test the nonexistence of tokens. beusedastriggeringconditionsfortransitions. Specifically, a transition may happen if all its input places Statechartssupportmanypowerfulprimitives,likeexcep- have tokens. But no action can be taken when there is no tions, group transitions, and history. As a result, their se- tokeninsomeinputplace.Theoretically,Petrinetsareequiv- manticsiscomplex.Hierarchicreactivemodule(HRM)isa alent to counter machines without zero-test capability [97] model description language for timed systems with restric- andvectoradditionsystems(VAS)[118],[132]. tions on transitions to simplify the semantics [14]. Syntac- SeveralclassesoftimedextensionsofPetrinetshavebeen tically, transitions in HRM can only connect to entry/exit proposed [3], [42], [47], [93], [163], [187]. For example, pointsofstructuralmodules.Transitionsareforbiddenfrom MerlinandFaberdefinedtimePetrinets,inwhicheachtran- jumpingdirectlytoinnermodules. sition is associated with a clock that records the time lapse Timed unified modelinglanguage (UML) is the real-time sinceitwaslastenabled[163].Clockreadingscanbenatural extensionofUML[72],whichisinturnavariationofstate- numbersindiscrete-timemodelsordensenumbersincontin- charts.TranslationschemesfromtimedUMLtovariousver- uous-time models. State may change due to transitions and ificationtoollanguageshavebeenstudiedandimplemented timepassage.Eachtransitionalsohastwoattributes:earliest [73],[88],[136],[146],[172]. firingtime(Eft)andlatestfiringtime(Lft).Anenabledtran- sition can only fire when its clock reading is no less than IV. VERIFICATIONFRAMEWORK its Eft, and if continuously enabled, it must be fired before Therearethefollowingfourmajorapproachestocompu- itsLft.Thus,timemaynotincrementbeyondtheminimum tationallyverifyingtimedsystems. deadlines set by the Lft of all enabled transitions. This se- manticsthat“someenabledtransitionmustfire”isdifferent A. SatisfiabilityChecking from the nondeterministic semantics of timed automata, in whichacontinuouslyenabledtransitiondoesnothavetobe Inthisframework,wewriteboththesystembehaviorde- firedbeforetheLft. scription andspecification aslogicformulasandtryto Ghezzietal.proposedanotherPetrinetextension,called prove that is a theorem (i.e., tautology) of the un- Time Environment/Relation (ER) nets, for timed systems derlyingaxioms.Inreality,weusuallycheckif isa [93]. Each token, instead of each transition, is associated contradiction,orequivalently isunsatisfiable.Inthe with a time stamp. Transitions can be triggered only when implementation,wecanusethetableaumethodtoconstruct the earliest time and latest time requirements are met with an untimed Kripke structure and check if is satis- respecttothetokentimestamps.Theyalsopresentedthree fiedattheinitialnodesinthestructure.Atableauisasmall WANG:FORMALVERIFICATIONOFTIMEDSYSTEMS:ASURVEYANDPERSPECTIVE 1289 modelthatcanbeusedtochecktheexistenceofamodelfor flag,sincenomatterwhenwefreeze to ,thetruthvalue .Conceptuallyitisadirectedgraph suchthat of isalreadydeterminedatthemomentwhen isthesetofpossibleworlds(orstates)and isthesetof isgenerated. transitionsfromworldtoworld. The small modeltheorem of TPTL says thatif there is a Inthefollowing,weillustratethetableauconstructionfor modelfor ,thenthereissuchamodel: TPTLsatisfiabilitychecking[15].Assumethatwearegiven • whose nodes are in the powerset of and aTPTLformula suchthatnegationsonlyappearinfrontof satisfythenodeconsistencycondition;and atomicconstraintslike and .Thisispossible • whose transitions satisfy the transition consistency because of deMorgan’s law and , condition;and ,and . • thatcontainsacyclesuchthat GivenaTPTLformula , isasetofTPTLfor- — thecycleisreachablefromaninitialstatenode;and mulasconstructedwiththefollowinginductionrules. — if islabeledinsomenodeinthecycle,thereis • andtrue . anothernodelabeledwith inthecycle;and • If or , — if islabeledinsomenodeinthecycle,there then and . isanothernodelabeledwith inthecycle. • If , then , , The satisfiability problem of linear-time temporal logics . TPTL [15], TETL, MTL [16], and APTL [228] are EX- • If , then , PSPACE-complete. . Itisalsopossibletousetemporallogicswithdense-time • If , then , semantics to do satisfiability checking. However, the satis- . fiability problems of TPTL with dense-time semantics and • If ,then . TCTLareallundecidable[5],[16] • If , then where is the symbol for current time and is identical to except that every B. ModelChecking occurrence isreplacedby . The framework of model checking [60], [61] means that • If where , thesystemdescriptionsaregivenasautomata,thespecifica- and ,then tionformulasaregivenastemporallogicformulas,and we .Thecasefor issymmetric. wanttocheckifallmodelsofagivensystemdescriptionsat- Here,forconvenience,weassumeonlyinequalitieslike isfy a given specification formula. One popular framework ,where and areclockvariablesand and in this category is the TCTL model-checking problem [5] are used. inwhichthesystemdescriptionsaretimedautomata,while Anode in for isasubsetof thatsatisfies the specifications are TCTL formulas. The TCTL model- thefollowingnodeconsistencyconditions. checkingproblemisPSPACE-complete.Notethattheframe- • true . workin[5]onlypermitsatomicconstraintslike with • If ,thetruthvalueof isin . . For about one decade, people have • If ,then . straightforwardly extended the framework with constraints • If ,then or . like [113]. Recently, Bouyer [46] showed that • If ,then and . themodel-checkingalgorithmsin[5],[113]isnotcorrectfor • If ,theneither orboth and suchanextension. . Animportantsubclassinthemodel-checkingframework • If ,thenboth and . is safety checking, i.e., the model checking of formulas • If ,theneither or . like where is a propositional formula for the safety • If ,then . propertyofasystem.Inimplementation,thesafetyanalysis problem is usually translated to the negation of the reach- If ,thenthefollowingtransitionconsistencycon- ability problem, i.e., whether is true or not. Most of ditionsmustalsobemaintainedin ,i.e.,exactlyoneofthe the implementations in model checking have focused on followingtwoistrue. the efficiency enhancement of safety checking. The major 1) Forall ,then . reason for this may be that fully model checking complex 2) Forall ,then ,where isidentical timedsystemsisindeedtoodifficult. to exceptthateveryconstraintlike with It is also possible to model check linear-time temporal , isrespectivelyreplacedwith . logics like TPTL [15] or MTL [16]. In this framework, we (Thecasefor issymmetric.) wanttoverifythateverycomputationofthetimedautomata Case 1 models the passage of zero time units, while case 2 isalsoastatesequenceofthelinear-timeproperty. modelsthepassageofonetimeunit.Alsonotethatwhena Modelcheckinghasalsobeenappliedtoframeworksother constraintlike isgenerated,wewillnolonger thanautomata.FDRisacommercialmodel-checkerforCSP askforthedecrementsfrom .Thus, servesasa but does not quite support real-time system modeling [89]. 1290 PROCEEDINGSOFTHEIEEE,VOL.92,NO.8,AUGUST2004 Theideaistocheckwhether,byhidingsomeinternalvari- • foreveryinitialstate of ,thereisaninitialstate ables, a behavior description in CSP can be identified as a of suchthat . refinementofanotherspecificationinCSP. Timed simulation has been used extensively for systems Thereisalsomodel-checkingresearchforPetrinets.One modeled with various extensions of I/O automata [44], common approach is to put in restrictions to reduce Petri [105], [141], [154]–[156], [160]. Since I/O automata [133] nets to finite-state systems, which are then subject to algo- have first-in-first-out (FIFO) queues and their verification rithmic model checking. In general, the reachability (of a problemisingeneralundecidable,alotoftheworkwascar- specificationmarking)problemofPetrinetsisdecidablebut ried out using theorem provers (see Section IV-D). Tas¸Iran without known elementary complexity. Another commonly etal.showedthatthesimulationcheckingproblemfortimed acceptedframeworkforverificationwithPetrinetsiscalled automataisEXPTIME[209]. thecoverabilityproblem,inwhichwearegivenaspecifica- The third alternative is timed bisimulation, which is also tionmarking andwanttoseeifthereisareachablemarking a relation between states of two (timed) automata at an ab- suchthat isnolessthan placebyplace. straction level. For convenience, given a relation , we let . Given two model descriptions and , a relation is a timed bisimulation between and C. Simulation iff isatimedsimulationfrom to and isatimed It is also possible to use state-transition systems (au- simulationfrom to .Cˇera¯nsshowedthattimedbisimu- tomata) for both system behavior descriptions and specifi- lationcheckingisdecidable[55].Lasotashowedthattimed cations.Thisframeworkcanbeusefulwhenaspecification bisimulationcheckingisalsodecidablefortimedbasicpar- is too complex to put down in temporal logics. After all, a allel processes (BPPs)9 [145]. Bisimulation-based verifica- pictureisworthathousandwords.Givenabehaviormodel tionoftimedautomatacanbefoundin[71],[153].Workon description andaspecification ,intuitively,wewantto discrete-timemodelscanbefoundin[147]–[149]. check whether simulates , i.e., every behavior of is also a behavior of with respect to the input and output D. TheoremProving events(i.e.,observableevents)andthetimesatwhichthose Thisapproachstemsfromveryearlyresearchinartificial events occur. However, we need to define behavior more intelligence [58]. In this framework, verification engineers clearly. manually designa verificationplan (proof sketch) and then Inlineartime,abehaviorisan(infiniteorfinite)sequence use theorem provers to mechanically check the correctness of events and the occurrence times of those events. Such a ofthereasoningstepsintheplan.Sincemanyofthetheorem sequencetogetherwiththeeventoccurrencetimesiscalled provers accept undecidable classes of logic formulas, the a timed trace. The framework of trace inclusion verifies approach usually does not guarantee the termination of whether implements ,i.e.,thetimedtracesof arealso individual mechanical verification tasks. If a user feels that timedtracesof .Thisframeworkmaynothavethepower a prover cannot finish a task, he/she may have to either todiscerncertainbehaviors.Forexample,inFig.1,although intervene with expertise (formalized as axioms or proof the two systems have the same set of traces, the choices at strategies) or change the verification plan. Fulfillment of statesarenotthesame.Inaddition,AlurandDillshowed a verification plan depends heavily on the users’ profound that the inclusion problem of timed traces is undecidable knowledgeoftheunderlyinglogicsandproficiencyinusing [12]. the tools. An alternative framework is simulation [158], [159], Variousalgorithmsweredevelopedtochecksubclassesof [209],which,informalverificationliterature,doesnotmean first-orderlogics.Shostak[202]andNelsonandOppen[173] that we build a mathematical model in the programming presentedalgorithmstodecideunquantifiedcombinationsof language C, execute the model with an inference engine, somefragmentsoffirst-orderlogics.Shostakalsopresented and then observe the trace [66], [224]. Instead, simulation algorithms(congruenceclosure)todecideequalitywithun- is a relation between states of two model descriptions at interpreted functions [200] and methods, like loop residue an abstraction level (regarding the same set of observable [201]andSUP-INF[199],todecidelineararithmetic.Oppen inputs and outputs). Given a behavior model description presentedalgorithmsforcheckingPresburgerarithmeticfor- andaspecification ,intuitively,wewanttocheckifthere mulas10[177].Techniquesfrompropositionalcalculus[52], is a simulation relation from to (i.e., simulates ). [98]canalsobeemployedtocheckpropositionalfragments Forconvenience,wewrite iffin ,wecantransit offirst-orderorhigh-orderlogics. from to byfirstlettingtimeprogressby (anonnegative There is also an extensivelibrary of term rewriting tech- real)andthenexecutingatransitionlabeledwithevent .A niquesforfirst-orderandhigherorderlogics[77],[135].Re- relation betweenthestatesetsof and isasimulation searchhasshownthatcontrolledheuristicsonterm-rewriting iffforevery : rulesareimportant. • and are the same, predicate by predicate, at the 9BPPsaresystemsconstructedwithrulesP ::=pjP kP j1.P ,where abstractionlevel; pisanatomicprocessand1.P istheprocessofthepassageofonetime unitfollowedbyprocessP . • if forsome ,then forsome 10Presburgerarithmeticisthetheoryoflinearconstraintslikec x +...+ of suchthat ;and c x (cid:24)d,Booleanoperators,andquantificationonvariablesx ;...;x . WANG:FORMALVERIFICATIONOFTIMEDSYSTEMS:ASURVEYANDPERSPECTIVE 1291 Shankar designed an operator (read “since” ) in a A DBM can represent a convex state space in the time state-based model in the well-documented theorem prover space. Efficient operations like intersection and normaliza- Prototype Verification System (PVS) [197]. The operator tion to all-pair shortest-path form, can be performed. But a measures the time that has elapsed since last held. It is DBMcannotrepresentaconcavestatespace. implemented with three axioms in PVS. The first specifies Annichini et al. [21] have extended DBM with parame- the initial value of each . The second and third respec- ters for the semialgorithmic analysis of counter and clock tivelydefinewhen shouldremainthesameandwhenit systems. should increment in an action. Users can also define their own axioms in PVS for convenience. Work along this line B. BDD-LikeDataStructures canbefoundin[24],[25],[117],and[193]. BDD[52]isaminimumcanonicalformforpropositional logic and has become an indispensible technology in hard- wareverification.Topologically,aBDDisanacyclicdirected V. REPRESENTATIONSOFSTATESPACES graphwithasinglesourceandtwosinks(forFALSEandTRUE, respectively).Itcanrepresentbothdisjunctionsandconjunc- Many verification frameworks rely on the analysis of tions.Eachnodeislabeledwithadecisionatom,andtheout- reachable state spaces. The efficient manipulation of rep- goingarcsare labeledwiththe valuesofthecorresponding resentations of reachable state spaces is fundamental to decisionatom.ItisminimumbecauseBDDhastheleastrep- efficient verification of real-time systems. One important resentation size for any state space with respect to a given work in this regard is [5], in which Alur et al. presented variable ordering. It is canonical because there is exactly a finite representation, called the region graph, for the oneBDDforanygivenstatespace.Thiscanonicalityfeature dense-time state space of timed automata, and then proved alsoimpliesthatequalitycheckingbetweenstatespacesand the PSPACE-completeness of the TCTL model-checking emptinesscheckingofastatespacecanbedoneefficiently. problem.Aregiongraphisadirectedgraphwhosenodesare ThefirstpapertodiscusshowtouseBDDtoencodezones calledregionsandwhosearcsrepresenteithertimeprogress (actually for asynchronous systems with clock jitters) was or discrete transitions between regions. A region is a state by Wang et al. in 1993 [227]. They discussed how to use subspace with three characteristics. The first is the control BDD with decision atoms like to model locationofthestates,thesecondistheintegerpartsofclock check timed automata. Here, and are timing constants readingsinthestatesuptothebiggesttimingconstantsused withmagnitudenogreaterthanthebiggestconstantusedin inthe automataand the TCTLformula,and the thirdis the the behavior model and specification. Each decision atom orderingamongthefractionalpartsofclockreadingsinthe canassumeaBooleantruthvalue.Theapproachmaysuffer states. from bad performance, since the size of the decision atom Region graphs are important in establishing complexity. domain isalready proportional to the timing constantsand, Forpracticalverification,symbolicdatastructurescanusu- thus, exponential to the input size. However, they did not ally yield more compact representations. In the following reportimplementationorexperiments.In1996,Balarinim- sections,wediscusssomeworkinthisregard. plemented the same scheme and reportedexperiments with approximation techniques [33]. In 1999, Møller et al. used A. Difference-BoundedMatrices the same idea to devise a data structure called a difference decisiondiagram(DDD)anddiscussedmanymanipulation SinceDillproposedtousethedifference-boundedmatrix techniques[168],[169]. (DBM) to record the time space of real-time systems [78], Thenumericaldecisiondiagram(NDD)[26]usesbinary the DBM has been adopted by two major model checkers: encodingforclockreadings,anditsperformanceisverysen- Kronos [75], [237] and UPPAAL [39] and has become the sitivetotiming-constantmagnitude. mostpopulardatastructureforsuchapurpose. The clock-difference diagram (CDD) [36] uses decision ADBMisatwo-dimensionalarray.EachentryinaDBM atomslike andlabelsarcswithdisjointintervals.Forex- recordsthedifferencebetweentwoclocks’readingsofastate ample,anodelabel togetherwithanarclabel(3,5]con- inthespacecharacterizedbytheDBM.Zeroisalsotreated stitutetheconstraint .CDDswereonlyused asa specialclock.Conceptually,givenaset ofclocks,a inUPPAAL[36] asrecordingdevices ofzonesconstructed DBM isamappingfrom toasetofelements withDBMs.Nomodel-checkingandreachabilityalgorithms like suchthat: wereimplementedwithCDDsin[36]. • iseither or ; RED[213],[214]encodestheorderingoffractionalparts • where is the of clock readings in the variable ordering and has achieved biggesttimingconstantusedinthereal-timesystemsor veryhighspaceefficiencyforsymmetricsystemswithlarge inthespecificationand meansanyconstantgreater numbers of clocks and small timing constants. RED is a than ;and canonicalrepresentationoftimedautomatastatesubspaces. • Butforlargetimingconstants,REDsperformancedegrades Foreachtwo , , meansthat rapidly. .AtimespacecharacterizablebyaDBMiscalled Then in 2001, Wang proposed the clock-restriction di- a zone. agram (CRD) [216]–[218], which has a structure similar 1292 PROCEEDINGSOFTHEIEEE,VOL.92,NO.8,AUGUST2004

See more

The list of books you might like

Most books are stored in the elastic cloud where traffic is expensive. For this reason, we have a limit on daily download.