Model-Driven Verifying Compilation of Synchronous Distributed Applications Sagar Chaki, James Edmondson

advertisement
Model-Driven Verifying
Compilation of Synchronous
Distributed Applications
Sagar Chaki, James Edmondson
October 1, 2014
MODELS’14, Valencia, Spain
© 2014 Carnegie Mellon University
Copyright 2014 Carnegie Mellon University
This material is based upon work funded and supported by the Department of Defense under
Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software
Engineering Institute, a federally funded research and development center.
Any opinions, findings and conclusions or recommendations expressed in this material are those of
the author(s) and do not necessarily reflect the views of the United States Department of Defense.
NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE
MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO
WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING,
BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY,
EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON
UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM
PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT.
This material has been approved for public release and unlimited distribution except as restricted
below.
This material may be reproduced in its entirety, without modification, and freely distributed in written
or electronic form without requesting formal permission. Permission is required for any other use.
Requests for permission should be directed to the Software Engineering Institute at
[email protected]
DM-0001691
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
2
Outline
•
Motivation
•
Approach
•
Sequentialization : SEQSEM & SEQDBL
•
Examples
•
Experimental Results
•
Synchronizer Protocol : 2BSYNC
•
Tool Overview & Demo
•
Future Work
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
3
Motivation
Distributed algorithms have always been important
•
File Systems, Resource Allocation, Internet, …
Increasingly becoming safety-critical
•
Robotic, transportation, energy, medical
Prove correctness of distributed algorithm
implementations
•
•
Pseudo-code is verified manually (semantic gap)
Implementations are heavily tested (low coverage)
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
4
Approach : Verification + Code Generation
Program in Domain Specific Language
Distributed
Application
Debug Application,
Refine Specification
Safety
Specification
Verification
Failure
Success
The Verifying Compiler:
A Grand Challenge for
computing research
Code
Generation
Tony Hoare
Binary
Run on Physical
Device
Run within
simulator
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
5
Verification
Model Checking
Program in Domain Specific Language
Distributed
Application
Safety
Specification
Automatic verification technique for finite
state concurrent systems.
•
Sequentialization
•
Assume
Synchronous
Model of
Computation
Single-Threaded
C Program
Specifications are written in propositional
temporal logic. (Pnueli 77)
•
Software Model Checking
(CBMC, BLAST etc.)
Failure
Developed independently by Clarke and
Emerson and by Queille and Sifakis in
early 1980’s.
ACM Turing Award 2007
Success
Computation Tree Logic (CTL), Linear
Temporal Logic (LTL), …
Verification procedure is an intelligent
exhaustive search of the state space of
the design
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
6
Code Generation
MADARA Middleware
Program in Domain Specific Language
Distributed
Application
Safety
Specification
A database of facts: ๐ท๐ต = ๐‘‰๐‘Ž๐‘Ÿ โ†ฆ
๐‘‰๐‘Ž๐‘™๐‘ข๐‘’
Node ๐‘– has a local copy: ๐ท๐ต๐‘–
•
update ๐ท๐ต๐‘– arbitrarily
•
publish new variable mappings
Add synchronizer protocol
Guarantee
Synchronous
Model of
Computation
•
Immediate or delayed
•
Multiple variable mappings
transmitted atomically
Implicit “receive” thread on each node
C++/MADARA Program
Compile
(g++,clang,MSVC, etc.)
Binary
•
Receives and processes variable
updates from other nodes
•
Updates ordered via Lamport
clocks
Portable to different OSes (Windows,
Linux, Android etc.) and networking
technology (TCP/IP, UDP, DDS etc.)
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
7
Synchronous Distributed Application (SDA)
Node ๐ŸŽ = ๐’‡๐ŸŽ ()
Shared Variables:๐‘ฎ๐‘ฝ = ๐‘ฎ๐‘ฝ ๐ŸŽ , ๐‘ฎ๐‘ฝ[๐Ÿ]
Node ๐Ÿ = ๐’‡๐Ÿ ()
๐‘ฎ๐‘ฝ๐ŸŽ
๐‘น๐’๐’–๐’๐’… ๐Ÿ
๐‘ฎ๐‘ฝ๐Ÿ ๐Ÿ = ๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐ŸŽ )
๐‘ฎ๐‘ฝ๐Ÿ [๐ŸŽ] = ๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ
๐‘น๐’๐’–๐’๐’… ๐Ÿ
๐‘ฎ๐‘ฝ๐Ÿ ๐Ÿ = ๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐Ÿ )
๐‘ฎ๐‘ฝ๐Ÿ [๐ŸŽ] = ๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐Ÿ
๐‘ฎ๐‘ฝ๐Ÿ
๐‘ฎ๐‘ฝ๐’Š−๐Ÿ
๐‘น๐’๐’–๐’๐’… ๐’Š
๐‘ฎ๐‘ฝ๐’Š ๐Ÿ = ๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐’Š−๐Ÿ )
๐‘ฎ๐‘ฝ๐’Š [๐ŸŽ] = ๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐’Š−๐Ÿ
๐‘ฎ๐‘ฝ๐’Š
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
8
SDA Verification
Program with ๐‘› nodes : ๐‘ƒ(๐‘›)
•
•
•
Each node has a distinct ๐‘–๐‘‘ ∈ 1, ๐‘›
Array ๐บ๐‘‰ has ๐‘› elements, ๐บ๐‘‰[๐‘–] writable only by node with id ๐‘–
Each element of ๐บ๐‘‰ is drawn from a finite domain
In each round, node with id ๐‘–๐‘‘ executes function ๐œŒ whose body is a statement
๐‘ ๐‘ก๐‘š๐‘ก โ‰” ๐‘ ๐‘˜๐‘–๐‘ | ๐‘™๐‘ฃ๐‘Ž๐‘™ = ๐‘’๐‘ฅ๐‘
(๐‘Ž๐‘ ๐‘ ๐‘–๐‘”๐‘›๐‘š๐‘’๐‘›๐‘ก)
| ๐ผ๐‘‡๐ธ ๐‘’๐‘ฅ๐‘, ๐‘ ๐‘ก๐‘š๐‘ก, ๐‘ ๐‘ก๐‘š๐‘ก
(๐‘–๐‘“, ๐‘กโ„Ž๐‘’๐‘›, ๐‘’๐‘™๐‘ ๐‘’)
| ๐ด๐ฟ๐ฟ ๐ผ๐‘‰, ๐‘ ๐‘ก๐‘š๐‘ก
(๐‘–๐‘ก๐‘’๐‘Ÿ๐‘Ž๐‘ก๐‘’ ๐‘œ๐‘ฃ๐‘’๐‘Ÿ ๐‘›๐‘œ๐‘‘๐‘’๐‘  โˆถ ๐‘ข๐‘ ๐‘’ ๐‘ก๐‘œ ๐‘โ„Ž๐‘’๐‘๐‘˜ ๐‘’๐‘ฅ๐‘–๐‘ ๐‘ก๐‘’๐‘›๐‘๐‘’)
| ๐‘ ๐‘ก๐‘š๐‘ก +
(๐‘–๐‘ก๐‘’๐‘Ÿ๐‘Ž๐‘ก๐‘–๐‘œ๐‘› ๐‘œ๐‘“ ๐‘ ๐‘ก๐‘Ž๐‘ก๐‘’๐‘š๐‘’๐‘›๐‘ก๐‘ )
๐‘™๐‘ฃ๐‘Ž๐‘™ โ‰” ๐บ๐‘‰ ๐‘–๐‘‘ ๐‘ค
(๐‘™๐‘ฃ๐‘Ž๐‘™๐‘ข๐‘’๐‘ )
๐‘’๐‘ฅ๐‘ โ‰” โŠค ⊥ ๐‘™๐‘ฃ๐‘Ž๐‘™ ๐บ๐‘‰ ๐‘–๐‘ฃ ๐‘ค ๐‘–๐‘‘ ๐ผ๐‘‰ โ‹„ (๐‘’๐‘ฅ๐‘+ )
(๐‘’๐‘ฅ๐‘๐‘Ÿ๐‘’๐‘ ๐‘ ๐‘–๐‘œ๐‘›๐‘ )
Initial states and “ERROR” states of the program are define
•
State ≡ value assigned to all variables
Verification ≡ decide if there is an execution of the program that starts in an initial
state and ends in an ERROR state
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
9
Semantic Sequentialization: SEQSEM
Node ๐ŸŽ = ๐’‡๐ŸŽ ()
Shared Variables:๐‘ฎ๐‘ฝ = ๐‘ฎ๐‘ฝ ๐ŸŽ , ๐‘ฎ๐‘ฝ[๐Ÿ]
๐‘จ๐’”๐’”๐’–๐’Ž๐’† ๐’ ๐’๐’๐’…๐’†๐’”
๐‘ผ๐’”๐’† ๐’ ๐’„๐’๐’‘๐’Š๐’†๐’” ๐’๐’‡ ๐‘ฎ๐‘ฝ
๐‘ถ ๐’๐Ÿ
๐’—๐’‚๐’“๐’Š๐’‚๐’ƒ๐’๐’†๐’” ⇒
๐‘บ๐’•๐’‚๐’•๐’† ๐‘ฌ๐’™๐’‘๐’๐’๐’”๐’Š๐’๐’
๐‘น๐’๐’–๐’๐’… ๐Ÿ
Node ๐Ÿ = ๐’‡๐Ÿ ()
๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ
๐‘ฎ๐‘ฝ๐’−๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ ๐ŸŽ =
๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ ๐Ÿ =
๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐Ÿ )
๐‘ฎ๐‘ฝ๐’−๐Ÿ ๐’ − ๐Ÿ =
๐’‡๐’−๐Ÿ (๐‘ฎ๐‘ฝ๐’−๐Ÿ )
๐‘ฎ๐‘ฝ๐ŸŽ ๐’Š =
๐‘ฎ๐‘ฝ๐’Š ๐’Š ,
๐’Š≠๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ ๐’Š =
๐‘ฎ๐‘ฝ๐’Š ๐’Š ,
๐’Š≠๐Ÿ
๐‘ฎ๐‘ฝ๐’−๐Ÿ ๐’Š =
๐‘ฎ๐‘ฝ๐’Š ๐’Š ,
๐’Š≠๐’−๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ
๐‘ฎ๐‘ฝ๐’−๐Ÿ
๐‘ถ๐’‘๐’†๐’“๐’‚๐’•๐’Š๐’๐’๐’” ๐’‰๐’‚๐’—๐’† ๐’Š๐’๐’…๐’†๐’‘๐’†๐’๐’…๐’†๐’๐’„๐’† ⇒ ๐’“๐’†๐’๐’“๐’…๐’†๐’“๐’†๐’… ๐’”๐’†๐’’๐’–๐’†๐’๐’•๐’Š๐’‚๐’๐’๐’š.
Sagar Chaki, October 1, 2014
๐‘น๐’๐’–๐’๐’…๐’” ๐’‚๐’“๐’† ๐’“๐’†๐’‘๐’†๐’‚๐’•๐’†๐’… ๐’Š๐’ ๐’‚ ๐’๐’๐’๐’‘.
Model-Driven Verifying Compilation
© 2014 Carnegie Mellon University
10
Double Buffering Sequentialization: SEQDBL
Node ๐ŸŽ = ๐’‡๐ŸŽ ()
Shared Variables:๐‘ฎ๐‘ฝ = ๐‘ฎ๐‘ฝ ๐ŸŽ , ๐‘ฎ๐‘ฝ[๐Ÿ]
๐‘ผ๐’”๐’† ๐Ÿ ๐’„๐’๐’‘๐’Š๐’†๐’” ๐’๐’‡ ๐‘ฎ๐‘ฝ
๐‘ผ๐’”๐’† ๐’†๐’‚๐’„๐’‰ ๐’„๐’๐’‘๐’š ๐’‚๐’” ๐’Š๐’๐’‘๐’–๐’•
๐’Š๐’ ๐’‚๐’๐’•๐’†๐’“๐’๐’‚๐’•๐’† ๐’“๐’๐’–๐’๐’…๐’”
๐‘น๐’๐’–๐’๐’… ๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ ๐ŸŽ =
๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ถ ๐’
๐’—๐’‚๐’“๐’Š๐’‚๐’ƒ๐’๐’†๐’”
๐‘น๐’๐’–๐’๐’… ๐Ÿ
Node ๐Ÿ = ๐’‡๐Ÿ ()
๐‘ฎ๐‘ฝ๐Ÿ ๐Ÿ =
๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐ŸŽ )
๐‘ฎ๐‘ฝ๐Ÿ ๐’ − ๐Ÿ =
๐’‡๐’−๐Ÿ (๐‘ฎ๐‘ฝ๐ŸŽ )
๐‘ฎ๐‘ฝ๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ ๐ŸŽ =
๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ ๐Ÿ =
๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐Ÿ )
๐‘ฎ๐‘ฝ๐ŸŽ ๐’ − ๐Ÿ =
๐’‡๐’−๐Ÿ (๐‘ฎ๐‘ฝ๐Ÿ )
๐‘ฎ๐‘ฝ๐ŸŽ
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
11
Example: 2D Synchronous Collision Avoidance
(3,3)
Y
(0,3)
Reserve
Reserve
(0,0)
Reserve
(3,0)
X
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
12
Example: 2D Synchronous Collision Avoidance
(3,3)
Y
(0,3)
Reserve
Reserve
Reserve
(0,0)
(3,0)
X
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
13
Example: 2D Synchronous Collision Avoidance
(0,3)
(3,3)
Y
Reservation
Contention
Resolved based
on Node ID. No
collision
possible if no
over-booking.
Potential
Collision
(0,0)
(3,0)
X
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
14
2D Collision Avoidance Protocol
If time to move to
next coordinate
REQUEST
NEXT
If no other node is
locking the next
coordinate
WAITING
Reached the next
coordinate
MOVE
Moving to the
next coordinate
If no other node
“with higher id” is
trying to lock the
next coordinate
๐‘ถ๐’•๐’‰๐’†๐’“ ๐‘ฌ๐’™๐’‚๐’Ž๐’‘๐’๐’†๐’”
3D Collision Avoidance
Model-Driven Verifying Compilation
Sagar Chaki, October
1, 2014
Mutual
Exclusion
© 2014 Carnegie Mellon University
15
Results: 3D Collision Avoidance
SEQDBL
is better
๐‘ป๐‘บ , ๐‘ป๐‘ซ = ๐’Ž๐’๐’…๐’†๐’ ๐’„๐’‰๐’†๐’„๐’Œ๐’Š๐’๐’ˆ ๐’•๐’Š๐’Ž๐’† ๐’˜๐’Š๐’•๐’‰ ๐‘บ๐‘ฌ๐‘ธ๐‘บ๐‘ฌ๐‘ด, ๐‘บ๐‘ฌ๐‘ธ๐‘ซ๐‘ฉ๐‘ณ
๐‘ป๐‘บ
๐, ๐ˆ = ๐‘จ๐’—๐’ˆ, ๐‘บ๐’•๐‘ซ๐’†๐’— ๐’๐’‡
๐‘ป๐‘ซ
Model-Driven Verifying Compilation
Sagar
Chaki,๐’”๐’Š๐’›๐’†
October 1, 2014
๐’ = #๐’๐’‡ ๐’๐’๐’…๐’†๐’” ๐‘น = #๐’๐’‡ ๐’“๐’๐’–๐’๐’…๐’”
๐‘ฎ×๐‘ฎ =
๐’ˆ๐’“๐’Š๐’…
© 2014 Carnegie Mellon University
16
Results: 2D Collision Avoidance
Depends
on the
example
๐‘ป๐‘บ , ๐‘ป๐‘ซ = ๐’Ž๐’๐’…๐’†๐’ ๐’„๐’‰๐’†๐’„๐’Œ๐’Š๐’๐’ˆ ๐’•๐’Š๐’Ž๐’† ๐’˜๐’Š๐’•๐’‰ ๐‘บ๐‘ฌ๐‘ธ๐‘บ๐‘ฌ๐‘ด, ๐‘บ๐‘ฌ๐‘ธ๐‘ซ๐‘ฉ๐‘ณ
๐‘ป๐‘บ
๐, ๐ˆ = ๐‘จ๐’—๐’ˆ, ๐‘บ๐’•๐‘ซ๐’†๐’— ๐’๐’‡
๐‘ป๐‘ซ
Model-Driven Verifying Compilation
Sagar
Chaki,๐’”๐’Š๐’›๐’†
October 1, 2014
๐’ = #๐’๐’‡ ๐’๐’๐’…๐’†๐’” ๐‘น = #๐’๐’‡ ๐’“๐’๐’–๐’๐’…๐’”
๐‘ฎ×๐‘ฎ =
๐’ˆ๐’“๐’Š๐’…
© 2014 Carnegie Mellon University
17
Results: Mutual Exclusion
SEQSEM
and
SEQDBL
similar
๐‘ป๐‘บ , ๐‘ป๐‘ซ = ๐’Ž๐’๐’…๐’†๐’ ๐’„๐’‰๐’†๐’„๐’Œ๐’Š๐’๐’ˆ ๐’•๐’Š๐’Ž๐’† ๐’˜๐’Š๐’•๐’‰ ๐‘บ๐‘ฌ๐‘ธ๐‘บ๐‘ฌ๐‘ด, ๐‘บ๐‘ฌ๐‘ธ๐‘ซ๐‘ฉ๐‘ณ
๐‘ป๐‘บ
๐, ๐ˆ = ๐‘จ๐’—๐’ˆ, ๐‘บ๐’•๐‘ซ๐’†๐’— ๐’๐’‡
๐‘ป๐‘ซ
Model-Driven Verifying Compilation
Sagar
Chaki,๐’”๐’Š๐’›๐’†
October 1, 2014
๐’ = #๐’๐’‡ ๐’๐’๐’…๐’†๐’” ๐‘น = #๐’๐’‡ ๐’“๐’๐’–๐’๐’…๐’”
๐‘ฎ×๐‘ฎ =
๐’ˆ๐’“๐’Š๐’…
© 2014 Carnegie Mellon University
18
Synchronizer Protocol: 2BSYNC
Node ๐ŸŽ = ๐’‡๐ŸŽ ()
Shared Variables:๐‘ฎ๐‘ฝ = ๐‘ฎ๐‘ฝ ๐ŸŽ , ๐‘ฎ๐‘ฝ[๐Ÿ]
๐‘ผ๐’”๐’† ๐’ƒ๐’‚๐’“๐’“๐’Š๐’†๐’“
๐’—๐’‚๐’“๐’Š๐’‚๐’ƒ๐’๐’†๐’”: ๐’ƒ๐ŸŽ , ๐’ƒ๐Ÿ
๐‘ฐ๐’๐’Š๐’•๐’Š๐’‚๐’๐’Š๐’›๐’†๐’… ๐’•๐’ ๐ŸŽ
Atomic Send. Either
both ๐‘ฎ๐‘ฝ๐ŸŽ [๐ŸŽ] and ๐’ƒ๐ŸŽ are
received, or none is
received. Can be
implemented on existing
network stack, e.g.,
TPC/IP
Node ๐Ÿ = ๐’‡๐Ÿ ()
๐‘ฎ๐‘ฝ๐ŸŽ , ๐’ƒ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ , ๐’ƒ๐Ÿ
๐’ƒ๐ŸŽ โ‰” ๐’ƒ๐ŸŽ + ๐Ÿ
๐’ƒ๐ŸŽ !
๐‘ฉ๐’‚๐’“๐’“๐ŸŽ
๐’ƒ๐Ÿ โ‰” ๐’ƒ๐Ÿ + ๐Ÿ
๐’ƒ๐Ÿ !
๐‘ฉ๐’‚๐’“๐’“๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ ๐ŸŽ = ๐’‡๐ŸŽ ๐‘ฎ๐‘ฝ๐ŸŽ
๐‘ฎ๐‘ฝ๐Ÿ ๐Ÿ = ๐’‡๐Ÿ (๐‘ฎ๐‘ฝ๐Ÿ )
๐’ƒ๐ŸŽ โ‰” ๐’ƒ๐ŸŽ + ๐Ÿ
๐‘ฎ๐‘ฝ๐ŸŽ ๐ŸŽ , ๐’ƒ๐ŸŽ !
๐‘ฉ๐’‚๐’“๐’“๐ŸŽ
๐‘ฉ๐’‚๐’“๐’“๐ŸŽ ≡ ๐’˜๐’‰๐’Š๐’๐’† ๐’ƒ๐Ÿ < ๐’ƒ๐ŸŽ ๐’”๐’Œ๐’Š๐’‘;
Implicit thread receiving messages and
updating variables
๐’ƒ๐Ÿ โ‰” ๐’ƒ๐Ÿ + ๐Ÿ
๐‘ฎ๐‘ฝ๐Ÿ ๐Ÿ , ๐’ƒ๐Ÿ !
๐‘ฉ๐’‚๐’“๐’“๐Ÿ
๐‘ท๐’“๐’๐’๐’‡ ๐’๐’‡ ๐’„๐’๐’“๐’“๐’†๐’„๐’•๐’๐’†๐’”๐’”
19
๐’Š๐’ ๐’‘๐’‚๐’‘๐’†๐’“
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
Tool Overview
Project webpage (http://mcda.googlecode.com)
•
Tutorial (https://code.google.com/p/mcda/wiki/Tutorial)
Verification
•
•
daslc --nodes 3 --seq --rounds 3 --seq-dbl --out tutorial-02.c tutorial02.dasl
cbmc tutorial-02.c (takes about 10s to verify)
Code generation & simulation
•
•
•
daslc --nodes 3 --madara --vrep --out tutorial-02.cpp tutorial-02.dasl
g++ …
mcda-vrep.sh 3 outdir ./tutorial-02 …
DEMO
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
20
Future Work
Improving scalability and verifying with unbounded number of rounds
Verifying for unbounded number of nodes (parameterized verification)
•
Paper at SPIN’2014 Symposium
Asynchronous and partially synchronous network semantics
Scalable model checking
•
Abstraction, compositionality, symmetry reduction, partial order reduction
Fault-tolerance, uncertainty, …
•
Combine V&V of safety-critical and mission-critical properties
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
21
QUESTIONS?
© 2014 Carnegie Mellon University
Contact Information Slide Format
Sagar Chaki
Principal Researcher
SSD/CSC
Telephone: +1 412-268-1436
Email: [email protected]
U.S. Mail
Software Engineering Institute
Customer Relations
4500 Fifth Avenue
Pittsburgh, PA 15213-2612
USA
Web
www.sei.cmu.edu
www.sei.cmu.edu/contact.cfm
Customer Relations
Email: [email protected]
Telephone:
+1 412-268-5800
SEI Phone:
+1 412-268-5800
SEI Fax:
+1 412-268-6257
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
23
Synchronous Collision Avoidance Code
MOC_SYNC;
NODE uav (id)
CONST X = 4; CONST Y = 4;
{
CONST NEXT = 0;
GLOBAL bool lock [X][Y][#N];
CONST REQUEST = 1;
LOCAL int state,x,y,xp,yp,xf,yf;
CONST WAITING = 2;
void NEXT_XY () { … }
CONST MOVE = 3;
void ROUND () {
INIT
{
FORALL_NODE(id)
state.id = NEXT;
//assign x.id and y.id non-deterministically
//assume they are within the correct range
//assign lock[x.id][y.id][id] appropriately
if(state == NEXT) { …
EXTERN int
state = REQUEST;
MOVE_TO (unsigned char x,
unsigned char y);
state = MOVE;
} else if(state == MOVE) { …
void INIT () { … }
FORALL_DISTINCT_NODE_PAIR (id1,id2)
state = WAITING;
} else if(state == WAITING) { …
NODE uav (id) { … }
//nodes don’t collide initially
} else if(state == REQUEST) { …
state = NEXT;
ASSUME(x.id1 != x.id2 || y.id1 != y.id2);
}
SAFETY {
FORALL_DISTINCT_NODE_PAIR (id1,id2)
}}}
void SAFETY { … }
ASSERT(x.id1 != x.id2 || y.id1 != y.id2);
}
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
24
Synchronous Collision Avoidance Code
if(state == NEXT) {
//compute next point on route
else if(state == MOVE) {
if(x == xf && y == yf) return;
//now we have the lock on (xp,yp)
NEXT_XY();
if(MOVE_TO()) return;
state = REQUEST;
lock[x ][y][id] = 0;
} else if(state == REQUEST) {
x = xp; y = yp;
//request the lock but only if it is free
if(EXISTS_OTHER(idp,lock[xp][yp][idp] != 0)) return;
state = NEXT;
}
lock[xp][yp][id] = 1;
state = WAITING;
} else if(state == WAITING) {
//grab the lock if we are the highest
//id node to request or hold the lock
if(EXISTS_HIGHER(idp, lock[xp][yp][idp] != 0)) return;
state = MOVE;
}
Model-Driven Verifying Compilation
Sagar Chaki, October 1, 2014
© 2014 Carnegie Mellon University
25
Download