of . Graph. . Transformation. . Systems. Arman Sheikholeslami. armanpts@mail.upb.de. Graph and GTS. Directed . Graph . is set of vertices.. is set of edges.. often used to model . static characteristics . ID: 255510
DownloadNote  The PPT/PDF document "Verification" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, noncommercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Verification of Graph Transformation Systems
Arman Sheikholeslami
armanpts@mail.upb.de
Slide2Graph and GTS
Directed Graph is set of vertices. is set of edges.often used to model static characteristics of a system.Graph Transformation System used to model behavior of a dynamic system. as initial graph. as a set of transformation rules.
2
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide3Chess
Transformed!
A7
Pawn
A8
A6
B
7
B8
Rook
A7
Pawn
A8
A6
B
7
B8
Rook
Transformed!
3
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide4Find a matching of in .Delete all vertices and edges in s.t. .Add all vertices and edges to s.t. .
How Transformation works?
H
4
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
G
A7
A6
Pawn
A5
A7
A6
A5
RHS
A7
A6
Pawn
LHS
A7
A6
Pawn
Pawn
Slide5Algebraic approachSingle pushout (SPO)If node deletion causes dangling edge, node is deleted along with dangled edge.Double pushout (DPO)If node deletion causes dangling edge, the rule is not applied.Not applicable in chess!
Formalization of GTS
LHS
RHS
G
H
A7
Pawn
A7
A7
A6
Pawn
A7
A6
LHS
RHS
G
H
A7
Pawn
Pawn
A7
A6
Pawn
A6
Pawn
5
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide6Transition System using SPO
Rule X
LHS
RHS
A7
A6
P
A7
A6
P
Rule Y
LHS
RHS
P
P
A5
A6
A7
A7
A6
A5
Rule Z
LHS
RHS
P
A7
A6
A5
B
5
K
A7
A6
A5
B
5
P
Rule X
Rule
Z
Rule Y
A7
A6
Pawn
A5
B
5
Knight
A7
A6
Pawn
A5
B
5
A7
A6
Pawn
A5
B
5
Knight
A7
A6
Pawn
A5
B
5
Knight
6
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide7Verification is to determine if behavior of system (semantic) to conform with specifications (properties).Properties of GTSconditions and restrains a GTS should satisfy.Semantic of GTSproducible transition system.
Verification of GTS
7
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide8Which properties of GTS can be verified?Safetysomething bad will never happen.e.g. a forbidden pattern (subgraph) is never reached.Livenesssomething good will eventually happen.e.g. Deadlockfreedom, security
Properties of GTS
A7
A6
Pawn
A5
B
5
Knight
Knight hit by Pawn!
Unsafe!
8
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide9Intuitively…
Rule X
LHS
RHS
A7
A6
P
A7
A6
P
Rule Z
LHS
RHS
P
A7
A6
A5
B
5
K
A7
A6
A5
B
5
P
Rule X
Rule
Z
Rule Y
A7
A6
Pawn
A5
B
5
Knight
A7
A6
Pawn
A5
B
5
A7
A6
Pawn
A5
B
5
Rule Y
LHS
RHS
P
A7
A6
A5
B
5
K
A7
A6
A5
B
5
P
A7
A6
Pawn
A5
B
5
Knight
9
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Hit pattern,
Unsafe!
Slide10Technically…
Semantics
Properties
Kripke Structure
Temporal Logic
Model Checker
B
A
C
D
E
Chess play Transition System
Avoid getting hit!
LTL:
B
10
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide11Problem statementseveral variables in a system with range of possible values.a state assigned to each possible concrete combination of variables.set of possible states is too large.This happens in almost every systemThat’s why we cannot have a complete verification of large systems e.g. OS.
State space explosion
x,y
11
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide12A worse case of State Space Explosion problem.Occurs when state set of system is endless.Infinite state space is created by application of rules in which LHS can be found in RHS.
Infinite State Space
LHS
RHS
G
H
12
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide13UnderapproximationAn abstraction (subset) of original graph (state set) satisfying less properties.Bounded Model CheckingOverapproximationAn abstraction (superset) of original graph (state set) satisfying more properties.Shape GraphsInductive InvarianceApplicable to both State Space Explosion and Infinite State Space problems
Solutions
13
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide14is the predefined absolute bound.Look for a bad pattern in bounded execution length.If no bad pattern found, increment () until a bad pattern is found.If and no bad pattern found, verification stops.system is not necessarily safe (underapprox.)
Bounded Model Checking
14
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Only movements of one level are modeled!
(K=1)
Slide15To shrink state space by abstractioninformation is discarded.how to retrieve it to create concrete instances?Local Shape Logic (LSL)a way to express additional information about nodes and edges in a graph.Shape graph is an abstract modelconcrete instances are built based on shape constraints.Still more than one precise instance can be produced (overapprox.).
Shape Graphs
15
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide16Shape Graphs
(example)
Abstraction
Reproduction
Not a valid
Instance!
Constraints:
There is exactly
one
Pawn
In :
A7
Pawn
A8
A6
B
7
B8
Rook
G
A7
Pawn
A8
A6
B
7
B8
Rook
Pawn
A7
Pawn
A8
A6
B
7
B8
Rook
G
16
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Cell
King
Queen
Rook
Pawn
Knight
Bishop
S
G
G
Slide17Investigate if transition from a safe state to an error state (forbidden pattern) is possibleApply the rules backwards from forbidden pattern.if safe state reached, the property is can be violated (it’s NOT Inductive Invariant).Instead of the whole graph, only borders are investigated (abstraction).
Inductive Invariance
A6
A7
A5
Pawn
B
5
Knight
A6
A7
A5
Pawn
B
5
Knight
17
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide18If the property is inductive invariantno rule can be used to reach forbidden pattern from a state is not forbidden pattern.the system is safe.If the property is not inductive invariantthe system still might be safe.forbidden pattern can be reached given any starting graph (overapprox.).
Inductive Invariant (cont.)
E4
E5
E3
Bishop
D4
D5
D3
Bishop
18
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
C2
C3
C1
D
7
D
8
Pawn
Bisho
p
Slide19What if we need to differentiate elements of graphs from each other?we need to use attributes to specify differences.Typed Attributed Graphs (TAG) introduces as extension.What if time has specific effect on the system?simple graphs do not care about time!Timed Graphs introduces as extension (also and extension to TAG).
19
Extensions
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide20A graph with vertices and edges having an attribute where is a graph and data vertices in .node attribute as data node with an edge from graph node to data node.edge attribute as data node with an edge from graph edge to data node.
Typed Attributed GTS
A7
Pawn
A8
A6
B
7
B8
Rook
Black
A data node indicating color
20
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide21Contains 3 rules to perform TGTClock Instance Ruleadds clock instances to graph.by using discrete or densetime model (timed automata), passing of time can be expressed.Invariant Rulerestrict the execution of the rule to a specific time interval.Timed Graph Transformation Rule normal graph transformation rule.
Timed GTS
21
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide22Timed GTS
(example)
Apply
Invariant rule
2
A7
Pawn
A8
Rook
A6
A7
Pawn
A8
Rook
CI
A6
Rule X
LHS
RHS
A7
A6
P
A7
A6
P
Apply
Clock Instance
rule
1
A7
Pawn
A8
Rook
CI
A6
Rule Y
LHS
RHS
A8
A7
R
A8
A7
R
22
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Apply Transformation rule
3
No
Yes
Slide23There are many studies about model checking of TCTL over timed automata.To reduce model checking TGTS to model checking of timed automata.to benefit from existing theories and tools.To do thatproduce TS for TGTS (automaton).reduce First OrderTCTL to TCTL.label automaton with atomic propositions holding in states.
Verification of TGTS
Timed GTS
FOTCTL Property
Automaton
TCTL Property
Labeled Automaton
TCTL Model Checker
1
2
3
23
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide24Verification of TGTS (example)
TCTL Model Checker
FOTCTL
TCTL
Timed GTS
Labeled

Automaton
Inv:
A7
Pawn
A8
Rook
CI
A6
A7
Pawn
A8
Rook
CI
A6
A7
Pawn
A8
Rook
CI
A6
A7
Pawn
A8
Rook
CI
A6

Automaton
A7
Pawn
A8
Rook
CI
A6
A7
Pawn
A8
Rook
CI
A6
CI_x
CI_x
24
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide2525
Question?!
Seminar Advanced Verification Techniques  Winter term 2012/13  University of Paderborn
Slide26Next Slides