Embed Size (px)
Citation preview
論理と検証技術
モデル検査と定理証明
２０１１年７月２９日
藤田 憲悦
状態遷移図 Mm×Mc
m： W1 → B0 → B1 → W0cat：W1↓
B0↓
B1↓
W0↓↑
W2
IW
W
catcat
猫とねずみ• 次のようなフィールド上で猫とねずみが追いかけっこをする
北
• ねずみは［北西］から、ネコは［南］からスタートする
• 隣り合うポイントにのみ動ける
• 先攻がねずみ、後攻がネコで交互に動く
• ネコがねずみを捕まえたらネコの勝ち
斜め線と勝利条件
• 斜め線が無い場合、初期位置での互いの距離の偶奇性で勝敗が決まる
・・・今回の初期位置では、ななめ線が無い場合、勝利条件を満たせない
• 斜め線の通過により偶奇性が変わるのが鍵
状態遷移図 Mm×Mc
m： W1 → B0 → B1 → W0cat：W1↓
B0↓
B1↓
W0↓↑
W2
IW
W
catcat
状態遷移図 Mm×Mc
m： W2←W1 → B0 → B1 → W0 → W1’ → B0’→B1’→W0’
cat：W1↓
B0↓
B1↓
W0↓↑
W2
I W
W
W
W
catcat
m
模倣と抽象化
• Mc = < Sc, Rc, Ic, Atom, Lc >• Ma = < Sa, Ra, Ia, Atom, La >• f : Sc→Sa がMcからMaへの模倣写像１．Lc(s) = La (f(s))２．Rc(s, t) ⇒ Ra(f(s), f(t))３．f(Ic) = Ia
• 保存定理：MｃからMaへの模倣写像が存在するなら，任意のLTL式Aに対して，
Ma |= A ⇒ Mc |= A
模倣射像 f:Mc→Ma
p p
Mc Ma
模倣射像 f:Mc→Ma
p p
Mc |= X X ￢ p Ma |= X X ￢ p
偽反例
f
f
プロセスPwhile True{
//non‐critical sectionx:=y+1;while y != 0 and x > y{}
//critical sectionx:=0;}
プロセスQwhile True{
//non‐critical sectiony:=x+1;while x != 0 and x < y{}
//critical sectiony:=0;}
排他制御（ベーカリーアルゴリズム）
NC
Wait
Critical
x:=y+1
x:=0
y!=0andx>y
o.w.
NC
Wait
Critical
y:=x+1
y:=0
x!=0andy>x
o.w.
プロセスPwhile True{
//non‐critical sectionx:=y+1;while y != 0 and x > y{}
//critical sectionx:=0;}
プロセスQwhile True{
//non‐critical sectiony:=x+1;while x != 0 and x < y{}
//critical sectiony:=0;}
排他制御（ベーカリーアルゴリズム）
NC
Wait
Critical
x:=y+1
x:=0
y!=0andx>y
o.w.
NC
Wait
Critical
y:=x+1
y:=0
x!=0andy>x
o.w.
|≠G(x<10)
プロセスPwhile True{
//non‐critical sectionx:=y+1;while y != 0 and x > y{}
//critical sectionx:=0;}
プロセスQwhile True{
//non‐critical sectiony:=x+1;while x != 0 and x < y{}
//critical sectiony:=0;}
模倣射像 g : N×N → { ZZ, pZ, Zp, lp, pl, pEq }
ZZ (x=y=0)pZ (x>0かつy=0)
g(x, y) = Zp (x=0かつy>0) 述語による N×N の分割lp (0<x<y)pl (0<y<x)pEq (0<x=y)
述語抽象化
N
N
4
3
2
1
0 1 2 3 4
lp g(x,y)
ZZ pZ
Zp
pl
pEq
N
N
4
3
2
1
0 1 2 3 4
lp
pEq
g(x,y)
ZZ pZ
Zp
pl
Abstract model: process P
Zp
lp
pEq
pl
pZZZ
x:=0
x:=y+1
x:=y+1
x:=y+1
x:=0
x:=0
x:=0
x:=y+1
x:=y+1x:=y+1
Abstract model: process P
Zp
lp
pEq
pl
pZZZ
x:=0
x:=y+1
x:=y+1
x:=y+1
x:=0
x:=0
x:=0
x:=y+1
x:=y+1
y:=0
x:=y+1
y:=0
y:=x+1
y:=x+1
y:=0y:=x+1
y:=0
y:=x+1y:=x+1
y:=x+1
Abstract model: process P
Zp
lp
pEq
pl
pZZZ
x:=0
x:=y+1
x:=y+1
x:=y+1
x:=0
x:=0
x:=0
x:=y+1
x:=y+1
y:=0
x:=y+1
y:=0
y:=x+1
y:=x+1
y:=0y:=x+1
y:=0
y:=x+1y:=x+1
y:=x+1
(x,y) : (0,0) →（1,0）→(1,2)→（0,2)→(3,2)→(3, 0)→ …..
Combined approach of Verification and model
checking ：D.A.Peled
System Model PropertiesVerify
Simulation
Model
Checking
＊ The adequacy of the simplification (abstraction).
＊ The essential properties are preserved.
Forward simulation:concrete Mc refines abstract Ma
• Forward simulation R ⊆ Sc×Sa：1. ∀ ic∈Ic ∃ia∈ Ia. R(ic, ia)2. R(s, r) ⇒ Lc(s) = La(r)3. s → s’ & R(s,r) ⇒ ∃r’.r → r’ & R(s’,r’)
r r’
s s’
∀ Concrete operation in Mc
∃ Abstract operation in Ma
State Relation R State Relation R
Forward simulation:concrete Mc refines abstract Ma
• Forward simulation R ⊆ Sc×Sa：1. ∀ ic∈Ic ∃ia∈ Ia. R(ic, ia)2. R(s, r) ⇒ Lc(s) = La(r)3. s → s’ & R(s,r) ⇒ ∃r’.r → r’ & R(s’,r’)
r r’
s s’
∀ Concrete operation in Mc
∃ Abstract operation in Ma
State Relation R State Relation R
Ma |= A ⇒ Mc |= A
￡[A]
∪￡[Ma]
∪￡[Mc]
Backward simulation:• Backward simulation Q ⊆ Sa×Sc：
1. ∀ ia∈Ia ∃ic∈ Ic. Q(ia, ic)2. Q(r, s) ⇒ La(r) = Lc(s) 3. r → r’ & Q(r, s) ⇒ ∃s’. s → s’ & Q(r’,s’)
r r’
s s’
∃ Concrete operation in Mc
∀ Abstract operation in Ma
State Relation Q State Relation Q
Ma |≠ A ⇒ Mc | ≠ A
Combined approach of Verification and model
checking ：D.A.Peled
System Model PropertiesVerify
Simulation
Model
Checking
System Model_c Model_a PropertiesVerify
Simulation
Model
Checking
Refinement layers in seL4 Verifi.(G.Klein, et. al. )
• All properties of abstract model also hold for the refined model:
• Abstract specification: MA
↑ high-level (abstract)• Executable specification: ME
↓ low-level (concrete, refined)• High-performance C implementation: MC
Refinement layers in seL4 Verifi.(G.Klein, et. al. )
• All properties of abstract model also hold for the refined model:
• Abstract specification: MA
↑ high-level (abstract)• Executable specification: ME
↓ low-level (concrete, refined)• High-performance C implementation: MC
• Th. MC refines ME, and ME refines MA.
Formally verified compiler(X. Leroy, et. al. )
• Safety properties on source code also hold for compiled code:
• Clight (subset of C program. lang.): MA
↓ compilation• 8 Intermediate languages ‥‥‥
↓ compilation• PowerPC assembly code: MC
• Semantic preservation: MC behaves following semantics of MA.
Comparison: verification and model checking
System Model_c Model_a PropertiesVerify
Simulation
Model
Checking
Implement.Spec. Spec_a Spec_cRefine
Simulation
Hoare 論理へ
• ⇒ 定理証明システムを活用した検証
JMLツールの例
• JMLツールの調査
定理証明器の活用
• Coqの例
Java プログラムの検証
• ⇒ Krakatoaへ
Mulメソッドの検証
• Breunesse, Catano, Huisman, Jacobs:Formal methods for smart cards: an experience report,Science of Computer Programming 55 (2005) 53—80
• Short 型16bit で小数の積の計算をする mul メソッドを実装して，定理証明システムLOOPで検証
Gemplus電子財布アプレット
• Genplusが開発したJava Card用電子財布
• Purseアプレット：入金，出金，外貨両替
• Card issuerアプレット：本人認証
• Loyaltyアプレット：ロイリャリティ・ポイント
(2^15 -1)
Mulメソッド
The “rest-part”
• a.b * e.f = a*e + a*0.f + 0.b * e + 0.b*0.f • b, f < 1000 and (b*f)/10^6 < 1
• decimal = a*e*PRECISION + a*f + e*b + (b*f)/10^3
• floor「(b*f)/10^3」• Overflow: “b*f” は short 型• Rounding:
(b*f)/10^3 ≠ (b/10^3 * f/10^3)*10^3
Original Specification (a.b*e.f)/*@ requires 0 <= f && f < PRECISION &&@ 0 <= e && e <= MAX_DECIMAL_NUMBER &&@ (e+1) * (intPart+1) < MAX_DECIMAL_NUMBER@ modifies decimal;@ ensures decimal = e * ¥old(intPart) * PRECISION@ + ¥old(intPart) * f@ + e * ¥old(decPart)@ + @ ( ( f > 100 && ¥old(decPart) > 100) ?@ ( ((¥old(decPart)/10) * (f/10)) / 10 ) :@ ( ( f > 100 && ¥old(decPart) <= 100) ?@ ( (¥old(decPart) * (f/10)) / 100 ) :@ ……….@ ( ( f <= 100 && ¥old(decPart) <= 100) ?@ ( (¥old(decPart) * f) / 1000 )))); ……….@*/private void mul(short e, short f) { ……….}
Original Specification (a.b*e.f)/*@ requires 0 <= f && f < PRECISION &&@ 0 <= e && e <= MAX_DECIMAL_NUMBER &&@ (e+1) * (intPart+1) < MAX_DECIMAL_NUMBER@ modifies decimal;@ ensures decimal = e * ¥old(intPart) * PRECISION@ + ¥old(intPart) * f@ + e * ¥old(decPart)@ + @ ( ( f > 100 && ¥old(decPart) > 100) ?@ ( ((¥old(decPart)/10) * (f/10)) / 10 ) :@ …………………………………………………
No overflow: (1000/10 * 1000/10) = 100*100 < 32767But rounding:( 999/10 * 999/10)/10 = (99 * 99)/10 = 9801/10 = 9800.999 * 0.999 = 0.998001 998!
0.b： b=a1a2a3
0.b * 0.f
Mul メソッドの検証
• PostCondition:
intPart*PRECISION + decPart= a*e*PRECIEION
+ a*f + e*b + (b*f)/10^3
a.b*e.f :
(a. b * e) < (a+1) * e
(0.f * a) < a
(0.f * 0.b) < 1
(a+1)*(e+1) = (e+1)*(intPart +1) < Max : PreCondition
参考資料へ
• Formal methods for smart cards• seL4: Formal Verification of an Operating
System Kernel• Formal verification of a realistic compiler• Software Reliability Methods
• The Seventeen Provers of the World• Survey: Verification Tools (Jave+JML)
