Question

是否可以使用Spin获取属性的多个（或所有）违规跟踪？

作为一个例子，我在下面创建了Promela模型：

byte mutex = 0;

active proctype A() {
A1: mutex==0; /* Is free? */
A2: mutex++;  /* Get mutex */
A3: /* A's critical section */
A4: mutex--;  /* Release mutex */
}

active proctype B() {
B1: mutex==0; /* Is free? */
B2: mutex++;  /* Get mutex */
B3: /* B's critical section */
B4: mutex--;  /* Release mutex */
}

ltl {[] (mutex < 2)}

它有一个天真的互斥实现。可以预期，进程A和B不能一起到达它们的关键部分，我写了一个LTL表达式来检查它。

运行

spin -run mutex_example.pml

显示该属性无效且正在运行

spin -p -t mutex_example.pml

显示违反该属性的语句序列。

Never claim moves to line 4     [(1)]
  2:    proc  1 (B:1) mutex_example.pml:11 (state 1)    [((mutex==0))]
  4:    proc  0 (A:1) mutex_example.pml:4 (state 1)     [((mutex==0))]
  6:    proc  1 (B:1) mutex_example.pml:12 (state 2)    [mutex = (mutex+1)]
  8:    proc  0 (A:1) mutex_example.pml:5 (state 2)     [mutex = (mutex+1)]
spin: _spin_nvr.tmp:3, Error: assertion violated
spin: text of failed assertion: assert(!(!((mutex<2))))
Never claim moves to line 3     [assert(!(!((mutex<2))))]
spin: trail ends after 9 steps
#processes: 2
                mutex = 2
  9:    proc  1 (B:1) mutex_example.pml:14 (state 3)
  9:    proc  0 (A:1) mutex_example.pml:7 (state 3)
  9:    proc  - (ltl_0:1) _spin_nvr.tmp:2 (state 6)

这表明陈述的顺序（由标签表示）＆＃39; B1＆＃39; - ＆GT; ＆＃39; A1＆＃39; - ＆GT; ＆＃39; B2＆＃39; - ＆GT; ＆＃39; A2＆＃39;违反财产，但还有其他交错选项导致（例如＆＃39; A1＆＃39; - ＆gt;＆＃39; B1＆＃39; - ＆gt;＆＃39; B2＆＃39; - ＆gt;＆＃39 ; A2＆＃39;。）

我可以让Spin给我多条（或全部）痕迹吗？

Answer 1

我怀疑你可以在 Spin 中获得所有违规痕迹。

例如，如果我们考虑以下模型，那么无限多反例。

byte mutex = 0;

active [2] proctype P() {
    do
       :: mutex == 0 ->
           mutex++;
           /* critical section */
           mutex--;
    od
}

ltl {[] (mutex <= 1)}

您可以做的是为验证程序使用不同的搜索算法，而可能会产生一些不同的反例

-search  (or -run) generate a verifier, and compile and run it
      options before -search are interpreted by spin to parse the input
      options following a -search are used to compile and run the verifier pan
        valid options that can follow a -search argument include:
        -bfs    perform a breadth-first search
        -bfspar perform a parallel breadth-first search
        -bcs    use the bounded-context-switching algorithm
        -bitstate   or -bit, use bitstate storage
        -biterate   use bitstate with iterative search refinement (-w18..-w35)
        -swarmN,M like -biterate, but running all iterations in parallel
            perform N parallel runs and increment -w every M runs
            default value for N is 10, default for M is 1
        -link file.c  link executable pan to file.c
        -collapse   use collapse state compression
        -hc     use hash-compact storage
        -noclaim    ignore all ltl and never claims
        -p_permute  use process scheduling order permutation
        -p_rotateN  use process scheduling order rotation by N
        -p_reverse  use process scheduling order reversal
        -ltl p  verify the ltl property named p
        -safety compile for safety properties only
        -i          use the dfs iterative shortening algorithm
        -a          search for acceptance cycles
        -l          search for non-progress cycles
    similarly, a -D... parameter can be specified to modify the compilation
    and any valid runtime pan argument can be specified for the verification

在Spin中询问多个（或所有）违规痕迹

1 个答案: