Model Checking of Biological
Systems
A Tools Perspective
Contents
• System Description
• Specifications
• CTL
• Examples
– Simple Cell Cycle
– Simple Cell Cycle – finding a bug in the model
– Modified Cell Cycle – proving the bug is fixed
Requirements of Formal Methods
Specification
System
Formal
Analysis
Engine
Requirements of Formal Methods
(Finite State Machine
Higher-order Logic Description
UML Description
Program in C / Java /
ML/C++…
Pi Calculus)
Specification
System
Formal
Analysis
Engine
System Description
• An unambiguous description of the system being
formally analyzed.
• We have seen one example of an unambiguous
description
– Pi Calculus
• We know other unambiguous descriptions very
well
– C Programs
– Finite State Machines
• NuSMV will take labelled finite state machines
as the system description.
Finite State Machines
• MODULE <identifier>
– MODULE cell
Finite State Machines
• MODULE <identifier>
variable_type can be
•Boolean
•Enumeration Type
{0,2,3,-1}, {1,0, OK}, {OK,
FAIL, running}.
•Range
0..100 , 0..1000
• VAR
– <variable_identifier> : <variable_type>;
– state : { interphase, prophase, metaphase,
anaphase, telophase };
Finite State Machines
The system should start
• MODULE <identifier>
• VAR
from some initial value(s).
variable_value can be a
boolean expression.
– <variable_identifier> : <variable_type>;
• allows nondeterministic choice
of initial state.
• ASSIGN
– init(<variable_identifier>) := variable_value;
• init(state) := interphase;
Finite State Machines
The system should know
• MODULE <identifier>
• VAR
– <variable_identifier> :
• ASSIGN
how to move from one
state to another
variable_value can be a
<variable_type>;
boolean expression or a
case expression.
• allows to choose
– init(<variable_identifier>) := variable_value;
the next state
depending on the
present state.
– next(<variable_identifier>) := variable_value;
• next (state) := case
state = interphase : { interphase , prophase };
state = prophase : metaphase ;
esac;
Our First Example
• MODULE cell
• VAR
state : { interphase, prophase, metaphase, anaphase, telophase };
• ASSIGN
init(state) := interphase;
next (state) := case
state = interphase : { interphase , prophase };
state = prophase : metaphase ;
state = metaphase: anaphase ;
state = anaphase : telophase ;
state = telophase : interphase ;
esac;
Requirements of Formal Methods
(Finite State Machine
Temporal Logic
Higher-order Logic Description
UML Description
Program in C/Java…
Pi Calculus)
(Finite State Machine
Higher-order Logic Description
UML Description
Program in C / Java /
ML/C++…
Pi Calculus)
Specification
System
Formal
Analysis
Engine
Specification
• An expectation from the system
– Need not be “the complete specification” of
the system
– Otherwise it would be a system description
itself !
• We need an unambiguous language to
describe a specification.
– A cell will not enter metaphase unless it has
passed prophase.
Specification Logics
• Temporal Logics
– The logic of tense or time
• Used in logic and philosophy
• Introduced by Amir Pneuli into computer science
– Turing Award Citation (1996):
"For seminal work introducing temporal logic into computing
science and for outstanding contributions to program and
system verification."
• Different Flavors :
– Computational Tree Logic (CTL)
– Linear Temporal Logic
(LTL)
• FORSPEC (Intel)
Computational Tree Logic
•
•
ctl_expr ::
simple_expr -- a simple boolean expression
–
–
–
–
–
–
–
| ( ctl_expr )
| ! ctl_expr
| ctl_expr & ctl_expr
| ctl_expr | ctl_expr
| ctl_expr xor ctl_expr
| ctl_expr -> ctl_expr
| ctl_expr <-> ctl_expr
-- logical not
-- logical and
-- logical or
-- logical exclusive or
-- logical implies
-- logical equivalence
•
•
•
•
•
•
| EG ctl_expr
| EX ctl_expr
| EF ctl_expr
| AG ctl_expr
| AX ctl_expr
| AF ctl_expr
-- exists globally
-- exists next state
-- exists finally
-- forall globally
-- forall next state
-- forall finally
•
•
| E [ ctl_expr U ctl_expr ]
| A [ ctl_expr U ctl_expr ]
-- exists until
-- forall until
Computation Tree
Interphase
Prophase
Interphase
Prophase
Interphase
Prophase
Metaphase
Metaphase
Anaphase
Metaphase
Anaphase
Telophase
Interphase
A
h
Telophase
Computation Tree
• Represents all possible
behaviours of the system
Interphase
Prophase
Interphase
– Each branch in the tree is a
possible non-deterministic
choice made by the system
– It may also be a choice forced
on the system by an input.
Prophase
Interphase
• CTL specifies properties of
the computational tree.
Prophase
Metaphase
Metaphase
Anaphase
Metaphase
Anaphase
Telophase
Interphase
Anaphase
Telophase
CTL – Boolean Operators
• The system should satisfy property1 and/or
property2
– Property1 | Property2
– Property1 & Property2
• If the system satisfies property 1, it must also
satisfy property 2.
– Property1 Î Property2
• The system satisfies either property 1 or
property 2 but not both.
– Property1 xor Property2
CTL – Next State Operators
• EX (ctl-expr)
– This formula is true iff ctl-expr is true in any
one next state.
• prophase Î EX (metaphase)
• interphase Î EX (prophase)
• AX (ctl-expr)
– This formula is true iff ctl-expr is true in all the
next states.
• interphase Î AX (prophase | interphase)
CTL – Always Operators
• EG (ctl-expr)
– This formula is true iff ctl-expr is true in ALL future
states along ANY path.
• prophase Î EG (metaphase | prophase | anaphase |
telophase | interphase )
• interphase Î EG (interphase)
• AG (ctl-expr)
– This formula is true iff ctl-expr is true in ALL future
states along ALL paths.
• interphase Î AG (metaphase | prophase | anaphase |
telophase | interphase )
CTL – Future Operators
• EF (ctl-expr)
– This formula is true iff ctl-expr is true in SOME
future states along SOME path.
• prophase Î EF (interphase )
• interphase Î EF (prophase)
• AF (ctl-expr)
– This formula is true iff ctl-expr is true in SOME
future states along ALL paths.
• interphase Î AF (interphase )
CTL – Until Operators
• E (ctl-expr1) U ctl-expr2
– This formula is true iff ctl-expr2 is true in SOME future
state along SOME path and ctl-expr1 is true in all
states before that state.
• E prophase U (metaphase)
• E (interphase | prophase) U (metaphase)
• A (ctl-expr1) U ctl-expr2
– This formula is true iff ctl-expr2 is true in SOME future
state along ALL paths and ctl-expr1 is true in all
states before that state.
• A interphase U ( prophase )
Can you model-check these
properties in your mind?
•
•
•
•
•
•
•
•
AG ( EF prophase )
AG ( AG interphase )
EG ( EG interphase )
AG (interphase Î X prophase)
EG (interphase Î X prophase)
EF (interphase)
AF (prophase)
EF (prophase)
Requirements of Formal Methods
(Finite State Machine
Temporal Logic
Higher-order Logic Description
UML Description
Program in C/Java…
Pi Calculus)
(Finite State Machine
Higher-order Logic Description
UML Description
Program in C / Java /
ML/C++…
Pi Calculus)
Specification
System
Formal
Analysis
Engine
(Model Checker
•
•
•
•
Discrete Finite State
Probabilistic
Real-Time
Hybrid
Theorem Prover
•
•
First-Order
Higher-Order)
Where to get NuSMV ?
• Windows:
– http://nusmv.fbk.eu/distrib/NuSMV-zchaff-2.4.2-i586pc-mingw32msvc.exe
• Linux:
– http://nusmv.fbk.eu/distrib/NuSMV-zchaff-2.4.2x86_64-linux-gnu.tar.gz
– This is what you are running if you are connecting to
the Church server.
•
ZCHAFF is for non-commercial purposes only. NO COMMERCIAL
USE OF ZCHAFF IS ALLOWED WITHOUT WRITTEN
PERMISSION FROM PRINCETON UNIVERSITY. Please contact
Sharad Malik (malik@ee.princeton.edu) for details.
Install and Run NuSMV on linux-64
•
•
•
•
tar -xvzf NuSMV-2.4.3-x86_64-linux-gnu.tar.gz
cd NuSMV-2.4.3-x86_64-linux-gnu
cd bin
./NuSMV –help
– If you do not get the following reply, there is something wrong /
» [ira@church bin]$ ./NuSMV -help
» *** This is NuSMV 2.4.3 (compiled on Tue May 22 16:34:38 UTC
2007)
» *** For more information on NuSMV see <http://nusmv.irst.itc.it>
» *** or email to <nusmv-users@irst.itc.it>.
» *** Please report bugs to <nusmv@irst.itc.it>.
» *** This version of NuSMV is linked to the MiniSat SAT solver.
» *** See
http://www.cs.chalmers.se/Cs/Research/FormalMethods/MiniSat
» *** Copyright (c) 2003-2005, Niklas Een, Niklas Sorensson
» Usage: ./NuSMV [-h | -help] [-int] [-load script_file] \
Example 1 – Cell Division
• MODULE main
• VAR
• state: {interphase, prephase, intraphase, metaphase,
anaphase, telophase};
• ASSIGN
• init(state) := interphase;
• next(state) := case
•
state = interphase : prephase ;
•
state = prephase : intraphase ;
•
state = intraphase : metaphase ;
•
state = metaphase : intraphase ;
•
state = intraphase : anaphase ;
•
state = anaphase : telophase;
•
state = telophase : intraphase;
•
esac ;
• CTLSPEC AF (state=intraphase)
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Example 2 – Cell Division with
counterexample
MODULE main
VAR
state: {interphase, prephase, intraphase, metaphase, anaphase,
telophase};
ASSIGN
init(state) := interphase;
next(state) := case
state = interphase : prephase ;
state = prephase : intraphase ;
state = intraphase : metaphase ;
state = metaphase : intraphase ;
state = intraphase : anaphase ;
state = anaphase : telophase;
state = telophase : intraphase;
esac ;
• CTLSPEC AG (state=prephase -> AX AX AX AX state =
anaphase );
Example 2 – Cell Division with
counterexample
• -- specification AG (state = prephase -> AX (AX (AX (AX
state = anaphase)))) is false
• -- as demonstrated by the following execution sequence
• Trace Description: CTL Counterexample
•
•
•
•
•
•
•
•
Trace Type: Counterexample
-> State: 1.1 <- state = interphase
-> State: 1.2 <- state = prephase
-> State: 1.3 <- state = intraphase
-- Loop starts here
-> State: 1.4 <- state = metaphase
-> State: 1.5 <- state = intraphase
-> State: 1.6 <- state = metaphase
Example 3 – Cell Division (fixed)
•
MODULE main
•
•
VAR
state: {interphase, prephase, intraphase1, metaphase,intraphase2, anaphase, telophase};
•
ASSIGN
•
init(state) := interphase;
•
•
•
•
•
•
•
•
•
next(state) := case
state = interphase : prephase ;
state = prephase : intraphase1 ;
state = intraphase1 : metaphase ;
state = metaphase : intraphase2 ;
state = intraphase2 : anaphase ;
state = anaphase : telophase;
state = telophase : interphase;
esac ;
•
•
CTLSPEC AF (state=intraphase1);
CTLSPEC AG (state = prephase -> AX AX AX AX (state = anaphase) );
Example 3 – Cell Division (fixed)
•
•
•
•
•
[ira@church bin]$ ./NuSMV cell-division-fixed.smv
*** This is NuSMV 2.4.3 (compiled on Tue May 22 16:34:38 UTC 2007)
*** For more information on NuSMV see <http://nusmv.irst.itc.it>
*** or email to <nusmv-users@irst.itc.it>.
*** Please report bugs to <nusmv@irst.itc.it>.
•
•
•
*** This version of NuSMV is linked to the MiniSat SAT solver.
*** See http://www.cs.chalmers.se/Cs/Research/FormalMethods/MiniSat
*** Copyright (c) 2003-2005, Niklas Een, Niklas Sorensson
• -- specification AF state = intraphase1 is true
• -- specification AG (state = prephase -> AX
(AX (AX (AX state = anaphase)))) is true
Download NuSMV Manuals
• User’s Guide:
– http://nusmv.fbk.eu/NuSMV/userman/v24/nus
mv.pdf
• A smaller working tutorial to start with:
– http://nusmv.fbk.eu/NuSMV/tutorial/v24/tutoria
l.pdf