README 11 KB
Newer Older
1
2
3
The DiVinE 2 model checker
[http://web.archive.org/web/20120723095042/http://divine.fi.muni.cz/index.html]
used to have a specification language called DVE, for modelling
4
processes synchonizing through channels
5
[http://web.archive.org/web/20120723095115/http://divine.fi.muni.cz/language.html].
6
7

A lot of models can be found in the BEEM database at
8
http://paradise.fi.muni.cz/beem/
9

10
11
The LTSmin group [https://ltsmin.utwente.nl/] patched
DiVinE and to compile models as dynamic libraries. This dynamic
12
library provides a very simple C interface (no C++) and extra
13
14
15
information about state variables (name, type, possible values).
They also distribute SpinS, a compiler for PROMELA models generating
dynamic libraries with the same interface.
16

17
18
19
20
21
Spot uses this interface so you will need to install their version of
these tools to use Spot with DVE or PROMELA models.

The source code for our interface is in spot/ltsmin/ and generates a
separate library, libspotltsmin.so, that has to be linked in addition
22
23
24
25
26
27
28
29
30
31
32
33
to libspot.so.  The current directory contains some testing code based
on a toy modelchecker built upon the above interface: using it require
an installation of DiVinE or SpinS (preferably both for testing
purpose).


Installation of DiVinE
======================

Use the following commands to compile and install the patched version
of DiVinE.

34
35
  git clone https://gitlab.lrde.epita.fr/spot/divine-ltsmin-deb
  cd divine-ltsmin-deb
36
37
38
39
40
41
42
43
44
45
  mkdir _build && cd _build
  cmake .. -DMURPHI=OFF -DHOARD=OFF -DGUI=OFF -DRX_PATH= -DCMAKE_INSTALL_PREFIX=$HOME/usr
  make
  make install

The CMAKE_INSTALL_PREFIX variable is the equivalent of the --prefix
option of configure scripts.  If you decide to install in $HOME/usr
like I do, make sure that $HOME/usr/bin is in your PATH.  If you omit
the CMAKE_INSTALL_PREFIX setting, it will default to /usr/local.

46
47
48
49
50
51
If you are using MacOS, you must add option -DHOARD=OF to the cmake
command line in order to  make it compile without errors. Also,
DiVinE 2 only compiles with the GNU std C++ library; as a consequence,
you must provide the option -DCMAKE_CXX_FLAGS="-stdlib=libstdc++" to
the cmake command line.

52
53
54
55
56
57
58
The above git repository is our own copy of the LTSmin fork of Divine,
that we patched to generate Debian packages for amd64.  If you use
our Debian repository [https://spot.lrde.epita.fr/install.html#Debian]
you can actually install this version of divine with just:

  apt-get install divine-ltsmin

59
60
61
62
63
64
65
66
67
68
69
After installation, you can check that compilation works by running
the following command on any DVE model.  It should create a file
model.dve2C (which is a dynamic library).

  divine compile --ltsmin model.dve


Installation of SpinS
======================

The extended version of SpinJa is called SpinS and should be included
70
71
72
with LTSmin.  You can download LTSmin from their website
[http://ltsmin.utwente.nl/] and install it following the INSTALL
instructions.
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146

To compile a promela model, simply run the following command:
  spins model.pm

It should create a dynamic library called model.pm.spins in the
current directory.


Usage with Spot
===============

  The function load_dve2() defined in dve2.hh in this directory will
  accept either a model or its compiled version as file argument.  In
  the former case, it will call "divine compile --ltsmin model.dve" or
  "spins model.pm" depending on the file extension, only if a compiled
  model with the corresponding file extension (.dve2C or .spins) does
  not exist or is older.  Then it will load the compiled model
  dynamically.

  load_dve2() also requires a set of atomic propositions that should
  be observed in the model.  These are usually the atomic propositions
  that occur in the formula to verify, but it might be a larger set.

  There are two kinds of atomic propositions, those that refer to the
  state of a process, and those that compare the value of a variable.
  Let's have some example on an excerpt of the beem-peterson.4.dve
  model included in this directory:

    byte pos[4];
    byte step[4];

    process P_0 {
    byte j=0, k=0;
    state NCS, CS, wait ,q2,q3;
    init NCS;
    trans
     NCS -> wait { effect j = 1; },
     wait -> q2  { guard j < 4; effect pos[0] = j;},
     q2 -> q3 { effect step[j-1] = 0, k = 0; },
     q3 -> q3 { guard k < 4 && (k == 0 || pos[k] < j); effect k = k+1;},
     q3 -> wait { guard step[j-1] != 0 || k == 4; effect j = j+1;},
     wait -> CS { guard j == 4; },
     CS -> NCS { effect pos[0] = 0;};
    }

  The following atomic propositions could be used in LTL formula:

    P_0.CS          Process P_0 is in state CS.
    "pos[3] < 3"    Global variable pos[3] is less than 3.
    "P_0.j >= 2"    Process P_0's variable j is greater or equal to 2.
    P_0.j           This is equivalent to "P_0.j != 0".

  Comparison operators available are "<", ">", ">=", "<=", "==", and
  "!=".  The left operand should always be a variable and the right
  operand should always be a number, so you cannot write something
  like "P_0.j <= P_0.i".

  Because the LTL parser knows nothing about the details of the
  languages we interface with, every atomic proposition that cannot be
  expressed using only alphanumeric characters (plus `_' and `.')
  should be enclosed in double quote.

  Caveat: "P_0.j >= 2" and " P_0.j>=2" (watch the spaces!) are
  considered to be two distinct atomic propositions with the same
  semantics.


Examples
========

  Using the modelcheck program built into this directory, we can verify
  that the critical section is accessed infinitely often by some
  processes using:

147
    % ./modelcheck --model beem-peterson.4.dve --formula '!GF(P_0.CS|P_1.CS|P_2.CS|P_3.CS)' --is-empty
148
149
150
151
    2239039 unique states visited
    0 strongly connected components in search stack
    11449204 transitions explored
    1024245 items max in DFS search stack
152
    111081 pages allocated for emptiness check
153
154
155
156
    no accepting run found

  Process P_0 can starve, waiting to enter in critical section:

157
158
159
160
161
162
163
     % ./modelcheck --model beem-peterson.4.dve --formula '!G(P_0.wait -> F P_0.CS)' --is-empty
     3978 unique states visited
     31 strongly connected components in search stack
     4723 transitions explored
     3302 items max in DFS search stack
     1099 pages allocated for emptiness check
     an accepting run exists (use -c to print it)
164
165
166
167

   Variable pos[1] is not always < 3 (this formula makes no sense, it
   is just to demonstrate the use of double quote).

168
     % ./modelcheck --model beem-peterson.4.dve --formula '!G("pos[1] < 3")' --is-empty
169
170
171
172
     130 unique states visited
     61 strongly connected components in search stack
     132 transitions explored
     130 items max in DFS search stack
173
174
     512 pages allocated for emptiness check
     an accepting run exists (use -c to print it)
175
176
177
178
179
180
181
182


Two state-compression techniques have been implemented as experiments.
Prefer the -Z option if your model use only non-negative value less
than 2^28, it is way faster than -z (which will work for all values).

Activating state compression will often reduce runtime.  Compare:

183
184
$ ./modelcheck --model beem-peterson.4.dve --formula '!GF(P_0.CS|P_1.CS|P_2.CS|P_3.CS)' --is-empty --timer

185
186
187
188
2239039 unique states visited
0 strongly connected components in search stack
11449204 transitions explored
1024245 items max in DFS search stack
189
190
111081 pages allocated for emptiness check
no accepting run found                       |    user time   |    sys. time   |      total     |
191
192
                  name | ticks        % | ticks        % | ticks        % |   n
-------------------------------------------------------------------------------
193
  loading ltsmin model |     0      0.0 |     0      0.0 |     0      0.0 |   1
194
       parsing formula |     0      0.0 |     0      0.0 |     0      0.0 |   1
195
running emptiness chec |   672    100.0 |    13    100.0 |   685    100.0 |   1
196
197
   translating formula |     0      0.0 |     0      0.0 |     0      0.0 |   1
-------------------------------------------------------------------------------
198
199
200
201
                 TOTAL |   672    100.0 |    13    100.0 |   685    100.0 |


$ ./modelcheck --model beem-peterson.4.dve --formula '!GF(P_0.CS|P_1.CS|P_2.CS|P_3.CS)' --is-empty --timer -z 2
202
203
204
205
206

2239039 unique states visited
0 strongly connected components in search stack
11449204 transitions explored
1024245 items max in DFS search stack
207
85991 pages allocated for emptiness check
208
no accepting run found
209
		       |    user time   |    sys. time   |      total     |
210
211
                  name | ticks        % | ticks        % | ticks        % |   n
-------------------------------------------------------------------------------
212
  loading ltsmin model |    40      6.1 |     2     16.7 |    42      6.2 |   1
213
       parsing formula |     0      0.0 |     0      0.0 |     0      0.0 |   1
214
215
running emptiness chec |   620     93.8 |    10     83.3 |   630     93.6 |   1
   translating formula |     1      0.2 |     0      0.0 |     1      0.1 |   1
216
-------------------------------------------------------------------------------
217
218
                 TOTAL |   661    100.0 |    12    100.0 |   673    100.0 |

219

220
It's a 14% speedup in this case, be the improvement can be more
221
important on larger models.
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281

The parallel deadlock detection has also been implemented is this tool:

% ./modelcheck --model beem-peterson.4.dve   --has-deadlock  --csv -p 1

       Thread #0: on CPU 0

       ---- Thread number : 0
       1119560 unique states visited
       3864896 transitions explored
       78157 items max in DFS search stack
       1316 milliseconds
       Find following the csv: thread_id,walltimems,type,states,transitions
       @th_0,1316,NO-DEADLOCK,1119560,3864896

       Summary :
       No no deadlock found!
       Find following the csv: model,walltimems,memused,type,states,transitions
       #beem-peterson.4.dve,1317,103681,NO-DEADLOCK,1119560,3864896


Running the same algorithm with 3 threads save 40% of the computation time:

$ ./modelcheck --model beem-peterson.4.dve   --has-deadlock  --csv -p 3

       Thread #1: on CPU 1
       Thread #2: on CPU 2
       Thread #0: on CPU 0

       ---- Thread number : 0
       417923 unique states visited
       1418775 transitions explored
       56403 items max in DFS search stack
       819 milliseconds
       Find following the csv: thread_id,walltimems,type,states,transitions
       @th_0,819,NO-DEADLOCK,417923,1418775

       ---- Thread number : 1
       526175 unique states visited
       1813440 transitions explored
       69322 items max in DFS search stack
       819 milliseconds
       Find following the csv: thread_id,walltimems,type,states,transitions
       @th_1,819,NO-DEADLOCK,526175,1813440

       ---- Thread number : 2
       404501 unique states visited
       1411645 transitions explored
       61888 items max in DFS search stack
       819 milliseconds
       Find following the csv: thread_id,walltimems,type,states,transitions
       @th_2,819,NO-DEADLOCK,404501,1411645

       Summary :
       No no deadlock found!
       Find following the csv: model,walltimems,memused,type,states,transitions
       #beem-peterson.4.dve,820,158211,NO-DEADLOCK,404501,1411645

One can observe that when possible (i.e., if the OS allows it) we try
has much as possible to pin threads to a CPU.