Methods and Tools for Validation

Transkript

1 Methods and Tools for Validation Modelling and nalysis Research Profile Distributed Systems & Semantics Unit Semantic Models concurrency, mobility, objects real-time, hybrid systems Validation & Verification algorithms & tools Construction real-time & network systems 2 1

2 BRICS Machine Basic Research in Computer Science Millkr alborg arhus Other revelvant projects UPPL, VHS, VVS, WOODDES 3 Tools Tools and BRICS pplications visualstte PVS HOL SPIN TLP UPPL LF Logic Temporal Logic Modal Logic MSOL lgorithmic (Timed) utomata Theory Graph Theory BDDs Polyhedra Manipulation Semantics Concurrency Theory bstract Interpretation Compositionality Models for real-time & hybrid systems 4 2

3 Indlejret software? 80% af al software er indlejret i interagerende apparater. Krav om stigende funktionalitet med minimale resourcer Udvikler skal ideelt set have adskillige kvalifikationer sofwarekonstr. og udvikl. hardware platforme, kommunikatíon & protokoller, validering (test og verifikation),. 5 very complex system Klaus Havelund, NS 6 3

4 Rotterdam Storm Surge Barrier 7 Spectacular Bugs RINE-5 INTEL Pentium II floating-point division 470 Mill US $ Baggage handling system, Denver 1.1 Mill US $/day for 9 months Mars Pathfinder Radiation theraphy, Therac-25. More in JPK, CW 8 4

5 Embedded Systems SyncMaster 17GLsi Mobile Phone Telephone Digital Watch Tamagotchi 9 simple program Int Int x x Process Process INC INC do do :: :: x<200 x<200 --> --> x:=x+1 x:=x+1 od od Process Process DEC DEC do do :: :: x>0 x>0 --> --> x:=x-1 x:=x-1 od od Process Process RESET RESET do do :: :: x=200 x=200 --> --> x:=0 x:=0 od od fork fork INC; INC; fork fork DEC; DEC; fork fork RESET RESET Which values may x take? Questions/Properties: E<>(x>1000) E<>(x>2000) [](x<=2000) E<>(x<0) Possibly [](x>=0) lways 10 5

6 Introducing, Detecting and Repairing Errors Liggesmeyer Introducing, Detecting and Repairing Errors Liggesmeyer

7 Suggested Solution? Model based validation, verfication and testing of software and hardware 13 Verification & Validation nalysis Design Model Specification Implementation Testing 14 7

8 Verification & Validation UML SDL Design Model nalysis Validation Specification Verification & Refusal Implementation Testing 15 Verification & Validation UML SDL Design Model Model Extraction utomatic Code generation Implementation nalysis Validation Specification Verification & Refusal Testing 16 8

9 Verification & Validation UML SDL Design Model Model Extraction utomatic Code generation Implementation nalysis Validation Specification Verification & Refusal utomatic Test generation Testing 17 How? Unified Model = State Machine! Input ports a b x! b? b? y! a? x y Output ports Control states 18 9

10 Tamagotchi B C LIVE Passive Feeding Meal B Light Care Health:= B Health-1 Snack Clean Tick Medicine Discipline Play Health=0 or ge=2.000 DED Health:=Health-1; ge:=ge+1 19 SYNCmaster 20 10

11 Digital Watch 21 The SDL Editor The SDL Editor Process level Process level 22 11

12 SPIN, Gerald Holzmann T&T 23 visualstte VVS w Baan Visualstate, DTU (CIT project) Hierarchical state systems Flat state systems Multiple and interrelated state machines Supports UML notation Device driver access 24 12

13 UPPL ESTEREL

14 State Explosion problem M1 a 1 2 M2 b c 3 4 M1 x M2 1,a 4,a 1,b 2,b 1,c 2,c 3,a 4,a 3,b 4,b ll combinations = exponential in no. of components 3,c 4,c Provably theoretical intractable 27 Train Simulator 1421 machines transitions 2981 inputs 2667 outputs 3204 local states Declare state sp.: 10^476 VVS visualstte BUGS? Our techniuqes has reduced verification time with several orders of magnitude (ex 14 days to 6 sec) 28 14

15 Modelling and nalysis Software Model No! nalysis Requirement F Yes 29 Modelling and nalysis Software Model Requirement F TOOL No! Debugging Information Yes, Prototypes Executable Code Test sequences Tools: UPPL, visualstte, ESTEREL, SPIN, Statemate, FormalCheck, VeriSoft, Java Pathfinder, 30 15

16 Modelling and nalysis Software Model Semantics BRICS No! Debugging Information Requirement F Logic TOOL lgorithmics Yes, Prototypes Executable Code Test sequences Tools: UPPL, visualstte, ESTEREL, SPIN, Statemate, FormalCheck, VeriSoft, Java Pathfinder, 31 Tool Support (model checking) System Description Requirement F TOOL No! Debugging Information Yes, Prototypes Executable Code Test sequences Tools: UPPL, visualstte, ESTEREL, SPIN, Statemate, FormalCheck, VeriSoft, Java Pathfinder, 32 16

17 Mest fundamentale model i datalogi: Kleene og Moore Tilstandsmaskiner Sprog versus adfærd Determinism versus non-determinisme Sammensætning og operationer Varianter af tilstandsmaskiner Moore, Mealy, IO automater, UML. Tilstandsmaskiner Beregningsmodel Mængde af tilstande En start tilstand Et input-alfabet En transitionsfunktion, der afbilleder input symboler og aktuel tilstand til en næste tilstand. En eller flere accept tilstande. Beregning starter fra start tilstand med en given inputstreng (læses fra venstre -> højre). inputstrenge Modulo 3 tæller inc dec inc dec inc dec inc inc dec inc inc dec inc inc inc dec inc dec inc dec inc 34 17

18 Tilstandsmaskiner Varianter inputstreng inc inc dec inc inc dec inc Maskiner kan have handlinger/output associeret med tilstande Moore Maskiner. 0 inc dec 1 inc dec inc 2 dec outputstreng 35 Tilstandsmaskiner Varianter inputstreng inc inc dec inc inc dec inc Maskiner kan have handlinger/output associeret med transitioner Mealy Maskiner. inc/1 dec/0 Transitioner ubetinget af input (nul-transitioner). inc/0 dec/2 inc/2 dec/1 Flere transitioner for et givet input og tilstand (non-determinisme) outputstreng 36 18

19 Tilstandsmaskiner Varianter lfabetets symboler opdelt i input- og output-handlinger (IO-automater) inc? 0! 1! dec? inc? dec? inc? dec? 2! 0! 0! 0! inc? inc? 2! 2! dec? 1! interaction 37 Bankbokskode For at åbne bankboksen skal koden indeholde mindst to? For at åbne bankboksen skal koden slutte med For at åbne bankboksen skal koden slutte med eller med O B G For at åbne bankboksen skal koden slutte med et palindrom f.eks

20 Fundamentale resultater Enhver non-deterministisk FTM (streng acceptor) kan transformeres til en determistisk FTM, der accepterer de samme strenge (potentiel eksplosion i størrelse). Givet FTM M findes en unik minimal deterministisk FTM M, der accepterer de samme strenge. Givet FTM M og M findes der FTM M der accepterer præcist strenge, der accepteres af enten (både) M eller (og) M. Strengene accepteret af en FTM M kan beskrives af regulære udtryk (og omvendt). 39 Sammensætning M1 a 1 2 M2 b c 3 4 M1 x M2 1,a 4,a 1,b 2,b 1,c 2,c 3,a 4,a 3,b 4,b 3,c 4,c lle lle kombinationer = eksponeltiel i i antallet af af maskiner 40 20

21 Sammensætning FSM, Moore & Mealy X X I I I B Y BY 41 Sammensætning FSM, Moore & Mealy X X I I I B O1 Y O2 BY O1+O

22 Sammensætning FSM, Moore & Mealy X X I!Y,Z I I Z B O1 Y O2 BY O1+O2 43 Sammensætning FSM, Moore & Mealy X X I Y,Z I O1 O2 B Y BY 44 22

23 Sammensætning IO utomater (2-vejs synkronisering) X X h! h? B Y BY 45 Sammensætning IO utomater X X k! h! h? k! C B Y CX BY 46 23