1		% (c) 2009-2025 Lehrstuhl fuer Softwaretechnik und Programmiersprachen,
2		% Heinrich Heine Universitaet Duesseldorf
3		% This software is licenced under EPL 1.0 (http://www.eclipse.org/org/documents/epl-v10.html)
4
5		:- module(model_checker,[is_deadlocked/1, node_satisfies_goal/1,
6		open_search/11,
7		expired_static_analysis_time/1,
8		proof_info_model_checking_incomplete/5, model_checking_is_incomplete/6,
9		perform_static_analyses/3, compute_transitions_opt/3,
10		get_model_check_stats/6,
11		find_invariant_error/4]).
12
13		:- use_module(module_information).
14		:- module_info(group,model_checker).
15		:- module_info(description,'The core model checker (does not treat LTL).').
16
17		:- use_module(b_interpreter,[state_violates_assertions/2]).
18		:- use_module(error_manager,[enter_new_error_scope/1, exit_error_scope/3, error_occurred_in_error_scope/0,
19		add_internal_error/2]).
20
21		:- use_module(specfile,[animation_mode/1,csp_mode/1]).
22		:- use_module(state_space,[visited_expression/2,transition/3, operation_not_yet_covered/1]).
23
24		:- use_module(probporsrc(static_analysis),[compute_dependendency_relation_of_all_events_in_the_model/3]).
25
26		:- use_module(state_space_exploration_modes,[depth_breadth_first_mode/1]).
27		:- use_module(bmachine,[b_machine_has_constants/0]).
28		:- use_module(state_space,[multiple_concrete_constants_exist/0]).
29
30		:- dynamic mc_found_error/2.
31
32		/* open_search: search for errors/goals among open nodes (i.e., not yet processed nodes)*/
33		/* LimitNr: max number of nodes to check, NodesAnalysed: number of nodes checked */
34		open_search(LimitNr,NodesAnalysed,LimitTime,Res,FindDeadlocks,FindInvViolations,
35		FindGoal,FindAssViolations,FindStateErrors,
36		StopAtFullCoverage,PartialOrderReduction) :-
37		animation_mode(MODE),
38		retractall(mc_found_error(_,_)),
39		initialise_optimisations(MODE,PartialOrderReduction,FindInvViolations,Optimisations),
40		perform_static_analyses(MODE,FindInvViolations,Optimisations),
41		%(error_manager:real_error_occurred -> print(error_after_perform_static_analyses),nl ; true),
42		depth_breadth_first_mode(DFMODE),
43		preferences:temporary_set_preference(do_invariant_checking,true,CHNG),
44		statistics(walltime,[ReferenceTime,_]),
45		get_model_check_stats(States,_Transitions,ProcessedTotal,Percentage,_,_),
46		% MEMO: used to cache expanded concrete_constants values
47		% particularly useful, e.g., for ../prob_examples/public_examples/B/PerformanceTests/LiftLargeWithLargeCst.mch
48		((\+ b_machine_has_constants ; multiple_concrete_constants_exist)
49		-> MEMO = '$disabled' % it could still be useful to cache one constant setup ??
50		; true),
51		enter_new_error_scope(ScopeID),
52		set_context_state(root),
53		open_search10(0,LimitNr,refstatus(ReferenceTime,Percentage,States,ProcessedTotal,ReferenceTime),
54		NodesAnalysed,LimitTime,MCRes,FindDeadlocks,FindInvViolations,
55		FindGoal,FindAssViolations,FindStateErrors,
56		StopAtFullCoverage,Optimisations,MODE,DFMODE,MEMO),
57		%tools_printing:print_term_summary(memo(MEMO)),nl,
58		exit_error_scope(ScopeID,_,open_search),
59		preferences:reset_temporary_preference(do_invariant_checking,CHNG),
60		clear_context_state,
61		(no_error_found_result(MCRes),
62		mc_found_error(Res,ID) % stored error because of mc_continue_after_error
63		-> set_counter_example_last_node(ID)
64		; Res=MCRes).
65
66		no_error_found_result(no).
67		no_error_found_result(all).
68
69		:- use_module(probsrc(tools),[statistics_memory_used/1]).
70		:- use_module(probsrc(debug),[silent_mode/1, formatsilent/3]).
71		:- use_module(library(random)).
72		open_search10(Nr,LimitNr,RefStatus,NodesAnalysed,LimitTime,Res,
73		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,FindStateErrors,
74		SFC,Optimisations,MODE,DF,MEMO) :-
75		%print(open_search(Nr,LimitNr,RefStatus)),nl,
76		Nr < LimitNr,!,
77		(\+ number(LimitTime)
78		-> open_search_do_one_node(Nr,LimitNr,RefStatus,NodesAnalysed,LimitTime,Res,
79		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,FindStateErrors,
80		SFC,Optimisations,MODE,DF,MEMO)
81		; statistics(walltime,[NewTime,_]),
82		(Nr mod 25 =:= 24, silent_mode(off) %, Nr\=0
83		-> RefStatus = refstatus(RefTime,RefPerc,PrevStates,PrevProcessed,StartTime),
84		Delta is NewTime-RefTime,
85		(Delta>20000 % more than 20 seconds since last progress message
86		% ; random(0,20000,X), X=<Delta)
87		-> get_model_check_stats(States,Transitions,ProcessedTotal,Perc,Ignored,ScopePerc),
88		(Ignored>0
89		-> format('~n* ~w states checked (~1f% of total ~w, ~1f% wo ~w ignored), ~w transitions,',
90		[ProcessedTotal,Perc,States,ScopePerc,Ignored,Transitions])
91		; get_current_breadth_first_level(Level)
92		-> format('~n* ~w states checked (~1f% of total ~w), ~w transitions, bf-level ~w, ',
93		[ProcessedTotal,Perc,States,Transitions,Level])
94		; format('~n* ~w states checked (~1f% of total ~w), ~w transitions,',
95		[ProcessedTotal,Perc,States,Transitions])
96		),
97		findall(Op,operation_not_yet_covered(Op),NotCov), length(NotCov,NrNotCov),
98		(NrNotCov = 1 -> format(' 1 operation not covered,',[])
99		; NrNotCov > 0 -> format(' ~w operations not covered,',[NrNotCov]) ; true),
100		statistics_memory_used(M), tools:print_mb(M),
101		DeltaProcessedStates is (ProcessedTotal-PrevProcessed),
102		NodesProcessedPerSec is DeltaProcessedStates*1000 / (NewTime-RefTime),
103		format('~n* currently checking ~2f states/sec',[NodesProcessedPerSec]),
104		DeltaStates is (States-PrevStates),
105		NodesPerSec is DeltaStates*1000 / (NewTime-RefTime),
106		format(', adding ~2f new states/sec~n',[NodesPerSec]),
107		RefStatus1 = refstatus(NewTime,Perc,States,ProcessedTotal,StartTime),
108		FullDeltaTime is NewTime - StartTime,
109		FullDeltaTimeMinutes is FullDeltaTime / 60000.0,
110		(Perc>RefPerc -> format('* walltime ~1f minutes~n',[FullDeltaTimeMinutes])
111		; format('* walltime ~1f minutes, percentage of checked states decreasing from ~1f%~n',[FullDeltaTimeMinutes,RefPerc]))
112		; RefStatus1 = RefStatus
113		)
114		; RefStatus1 = RefStatus
115		),
116		(NewTime>LimitTime, Nr>0
117		-> Res = [timeout,Nr], NodesAnalysed=Nr
118		; open_search_do_one_node(Nr,LimitNr,RefStatus1,NodesAnalysed,LimitTime,Res,
119		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,FindStateErrors,
120		SFC,Optimisations,MODE,DF,MEMO))
121		).
122		open_search10(N,_LimitNr,_RefStatus,N,_,no ,_,_,_,_,_,_,_,_,_,_MEMO).
123
124		% States: total number of states encounetered
125		% ProcessedTotal: number of states already processed
126		% Percentage: percentate of total processed
127		% Ignored: number of states ignored because not satisfying SCOPE predicate
128		% ScopePercentage: percentage processed taking into account ignored states
129		get_model_check_stats(States,Transitions,ProcessedTotal,Percentage,Ignored,ScopePercentage) :-
130		get_state_space_stats(States,Transitions,ProcessedTotal,Ignored),
131		Percentage is (100*ProcessedTotal / States),
132		InScope is (States-Ignored),
133		(InScope > 0 -> ScopePercentage is (100*ProcessedTotal / InScope) ; ScopePercentage = 100).
134
135		:- use_module(preferences,[preference/2]).
136		:- use_module(specfile,[prepare_state_for_specfile_trans/4]).
137		open_search_do_one_node(Nr,LimitNr,RefStatus,NodesAnalysed,LimitTime,Res,
138		FindDeadlocks,FindInvViolations,
139		FindGoal,FindAssViolations,FindStateErrors,
140		StopAtFullCoverage,Optimisations,MODE,DFMODE,MEMO) :-
141		get_next_node_to_check(FindInvViolations,ID,MODE,DFMODE),!,
142		update_context_state(ID), %print(treating_node(ID)),nl,
143
144		(preference(ignore_hash_collisions,true),
145		preference(forget_state_space,true)
146		-> retract_visited_expression(ID,CurState) %, retractall(id_to_marker(ID,_)) not necessary
147		; visited_expression(ID,CurState)),
148		(FindInvViolations=1 % compute invariant status
149		-> prepare_state_for_specfile_trans(CurState,ID,MEMO,PCurState),
150		tcltk_interface:compute_invariant_if_necessary(ID,PCurState,MODE)
151		; CurState=PCurState),
152		%print(processed_invariant(ID)), statistics(memory_used,M), tools:print_mb(M),nl,
153		!,
154		compute_transitions_opt(Optimisations,ID,PCurState),
155		%tools:print_message(mc(ID)),
156		%print(computed_all_transitions(ID)), statistics(memory_used,M2), tools:print_mb(M2),nl,
157		% !,
158		(open_search_check_for_error(ID,PCurState,Res,
159		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,
160		FindStateErrors,StopAtFullCoverage,MODE)
161		-> print_found_error(Res,ID),
162		NodesAnalysed=Nr,
163		set_counter_example_last_node(ID)
164		; N1 is Nr + 1,
165		open_search10(N1,LimitNr,RefStatus,NodesAnalysed,LimitTime,Res,
166		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,FindStateErrors,StopAtFullCoverage,
167		Optimisations,MODE,DFMODE,MEMO)
168		).
169		open_search_do_one_node(N,_LimitNr,_RefStatus,N,_,all,_,_,_,_,_,_,_,_,_,_MEMO) :-
170		formatsilent(user_output,'% Model checking finished, all open states visited~n',[]).
171
172		set_counter_example_last_node(ID) :-
173		tcltk_interface:tcltk_execute_trace_to_node(ID). % TO DO: allow to disable this when -nocounter option given
174
175		:- use_module(tools_printing,[format_with_colour_nl/4]).
176		print_found_error(goal_found,ID) :- !,
177		format_with_colour_nl(user_output,[green],'Found GOAL in state id ~w',[ID]).
178		print_found_error(full_coverage,ID) :- !,
179		format_with_colour_nl(user_output,[green],'Full coverage achieved in state id ~w',[ID]).
180		print_found_error(state_error(X),ID) :- nonvar(X),functor(X,F,_),!, % only print functor; term can be big
181		format_with_colour_nl(user_error,[red],'Found "~w" in state id ~w',[F,ID]).
182		print_found_error(X,ID) :-
183		format_with_colour_nl(user_error,[red],'Found "~w" error in state id ~w',[X,ID]).
184
185
186		%% Optimisation options (see first argument 'Optimisations'):
187		compute_transitions_opt(Optimisations,ID,CurState) :-
188		Optimisations = opt(PORPrefs,_),
189		compute_transitions(PORPrefs,ID,CurState).
190
191		compute_transitions(PORPrefs,ID,CurState) :-
192		PORPrefs = por(POROption,_UseEnableGraph,_Depth,_UsePGE),
193		(POROption==ample_sets;POROption==ample_sets2),!,
194		tcltk_interface: compute_ample_set(ID,CurState,PORPrefs).
195		compute_transitions(_,ID,CurState) :-
196		tcltk_interface: compute_all_transitions(ID,CurState).
197
198		:- use_module(preferences,[get_preference/2]).
199		:- use_module(specfile,[b_or_z_mode/1]).
200		:- use_module(state_space_exploration_modes,[get_open_node_to_check/2, get_current_breadth_first_level/1]).
201		%%get_next_node_to_check(1,ID,_) :- state_space:not_invariant_checked(ID). % if there is an existing node whose invariant we have not yet checked: check it now
202		get_next_node_to_check(_,ID,AnimMODE,DFMODE) :-
203		%(nonvar(ID) -> print(nonvar(ID)),nl ; true),
204		get_open_node_to_check(DFMODE,ID),
205		(b_or_z_mode(AnimMODE) -> assertz(not_invariant_checked(ID)) ; true).
206
207
208		:- use_module(state_space).
209		open_search_check_for_error(ID,PCurState,Res,
210		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,
211		FindStateErrors,StopAtFullCoverage,MODE) :-
212		open_search_found_error(ID,PCurState,Res,
213		FindDeadlocks,FindInvViolations,FindGoal,FindAssViolations,
214		FindStateErrors,StopAtFullCoverage,MODE),
215		(get_preference(mc_continue_after_error,false)
216		-> true
217		; print_found_error(Res,ID), % just print the error and try find more
218		%ajoin(['Found at state ',ID,':'],Msg), add_error(model_checker,'Found error:'Res),
219		% we could call analyse_invariant_for_state(ID)
220		\+ mc_found_error(_,_),
221		assertz(mc_found_error(Res,ID)), % store error to replay at end
222		fail
223		).
224
225		open_search_found_error(ID,CurState,Error,
226		_FindDeadlocks,1,_FindGoal,_FindAssViolations,_FindStateErrors,_StopAtFullCoverage,MODE) :-
227		find_invariant_error(MODE,ID,CurState,Error).
228		open_search_found_error(ID,_CurState,deadlock,1,_,_,_,_,_,_) :-
229		is_deadlocked(ID). %, print(deadlock(ID)),nl.
230		open_search_found_error(ID,CurState,assertion_violation,_,_,_,1,_,_,_MODE) :-
231		state_violates_assertions(ID,CurState).
232		open_search_found_error(ID,_CurState,ERR,_,_,_,_,1,_,_MODE) :-
233		state_space:state_error(ID,_,Error),
234		Error \== invariant_violated,
235		ERR = state_error(Error).
236		open_search_found_error(_ID,_CurState,general_error_occurred,_,_,_,_,1,_,_MODE) :-
237		error_occurred_in_error_scope. % enter_new_error_scope set up in open_search
238		%% we no longer use: error_manager:real_error_occurred ; errors can happen e.g. in POR static analysis
239		open_search_found_error(ID,CurState,goal_found,_,_,1,_,_,_,MODE) :-
240		node_satisfies_goal(ID,CurState,MODE).
241		open_search_found_error(_ID,_CurState,full_coverage,_,_,_,_,_,1,_MODE) :- % StopAtFullCoverage = 1
242		\+ operation_not_yet_covered(_).
243
244		find_invariant_error(b,ID,_CurState,invariant_violation) :- !, % here we know that invariant information has been computed
245		(invariant_violated(ID) -> true).
246		%find_invariant_error(b,_ID,CurState,invariant_false) :- !,
247		% preference(double_evaluation_when_analysing,true), % DOUBLE_EVALUATION
248		% CurState \= root, CurState \= concrete_constants(_),
249		% specfile:expand_const_and_vars_to_full_store(CurState,FullState), %print(eval_neg_inv(_ID)),nl,
250		% (b_interpreter:state_satisfies_negation_of_invariant(FullState)->true).
251		find_invariant_error(cspm,ID,_CurState,csp_error) :- !, % we know that only csp_can be possible
252		is_csp_error_state(ID).
253		find_invariant_error(MODE,ID,CurState,invariant_violation) :-
254		tcltk_interface:check_invariantKO(MODE,ID,CurState).
255		find_invariant_error(csp_and_b,ID,_CurState,csp_error) :- !, % xtl mode cannot apply
256		is_csp_error_state(ID).
257		find_invariant_error(MODE,ID,CurState,xtl_error) :-
258		is_xtl_error_state(ID,CurState,MODE).
259
260		:- use_module(error_manager,[add_warning/3]).
261		is_deadlocked(ID) :-
262		preferences:preference(forget_state_space,true),!, /* transitions not added */
263		(retract(state_space:transition(ID,_,_,_)) -> fail ; true).
264		is_deadlocked(ID) :- % ID must be ground upon call
265		%% visited_expression_id(ID),
266		deadlocked_state(ID),
267		\+ max_reached_or_timeout_for_node(ID),
268		(get_preference(store_only_one_incoming_transition,true)
269		-> add_warning(model_checker,'Deadlock may not exist and be caused by preference SAFETY_MODEL_CHECK being TRUE: ',ID)
270		; true).
271		/* \+((transition(ID,_,NID),NID \= ID)). <-- to detect more liberal form of DEADLOCK */
272
273		is_csp_error_state(ID) :-
274		transition(ID,io(_,error,_),_). /* <--- THE CSP has raised the error channel */
275
276		:- use_module(xtl_interface,[xtl_invariant_violated/1]).
277		is_xtl_error_state(_ID,CurState,xtl) :-
278		xtl_invariant_violated(CurState). /* <--- XTL has found unsafe configuration */
279		% ; AM=promela -> promela_property(CurState,unsafe)
280		% ; AM=smv -> smv_property(CurState,unsafe) ).
281
282
283		:- use_module(specfile,[animation_mode/1, b_or_z_mode/1, csp_mode/1]).
284
285		node_satisfies_goal(NodeID) :-
286		animation_mode(MODE),
287		(MODE=xtl
288		-> visited_expression(NodeID,State),
289		node_satisfies_goal(NodeID,State,MODE)
290		; node_satisfies_goal(NodeID,[],MODE) % we do not need the state
291		).
292
293		:- use_module(xtl_interface,[xtl_goal_found/1]).
294		:- use_module(bmachine,[b_get_machine_goal/1]).
295		node_satisfies_goal(NodeID,_,MODE) :- b_or_z_mode(MODE), !,
296		b_get_machine_goal(Goal),
297		eclipse_interface:test_boolean_expression_in_node(NodeID,Goal,'model checking GOAL'). % TODO: avoid re-expanding state
298		node_satisfies_goal(NodeID,_,MODE) :- csp_mode(MODE), !,
299		transition(NodeID,io(_,goal,_),_).
300		node_satisfies_goal(_,State,xtl) :-
301		xtl_goal_found(State).
302		% TO DO: allow LTL atomic properties like e(Op1), ...
303		% TO DO: seperate machine GOAL from MC goal; provide intermediate PROB fact and set_mc_goal/1
304
305		% ---------------------------------------
306
307		:- use_module(tools, [ajoin/2]).
308		:- use_module(symsrc(symmetry_marker),[hash_model_checking_imprecise/2]).
309		% Note: we do not need mcFindStateErrors flag
310		%model_checking_is_unsound(FindInvViolations,FindDeadlocks,FindGoal,FindAssViolations,Msg,Term)
311		model_checking_is_incomplete(FindInvViolations,FindDeadlocks,FindGoal,FindAssViolations,Msg,'') :-
312		proof_info_model_checking_incomplete(FindInvViolations,FindDeadlocks,FindGoal,FindAssViolations,Msg).
313		model_checking_is_incomplete(_FindInv,_FindDeadlocks,_FindGoal,_FindAss,Msg,Term) :-
314		(get_preference(symmetry_mode,hash),hash_model_checking_imprecise(ID,BasicType)
315		-> Msg = '*** Possibly not all states computed, symmetry hashing may be imprecise, e.g., for variable ',
316		translate:pretty_type(BasicType,S),
317		ajoin([ID,' : ',S],Term)).
318		model_checking_is_incomplete(1,_FindDeadlocks,_FindGoal,_FindAss,Msg,Term) :-
319		(time_out_for_invariant(ID)
320		-> Msg = '*** Timeout(s) occured during invariant computation, e.g., state with id = ', Term=ID).
321		model_checking_is_incomplete(_FindInv,_FindDeadlocks,_FindGoal,1,Msg,Term) :-
322		(time_out_for_assertions(ID)
323		-> Msg = '*** Timeout(s) occured during evaluation of ASSERTIONS, e.g., state with id = ', Term=ID).
324		model_checking_is_incomplete(_FindInv,_FindDeadlocks,_FindGoal,_FindAss,Msg,Term) :-
325		(max_reached_for_node(ID)
326		-> ((ID=root ; is_concrete_constants_state_id(ID))
327		-> get_preference(maxNrOfInitialisations,MI),
328		ajoin(['*** Not all transitions were computed as MAX_INITIALISATIONS=',MI,' was too small, e.g., for state with id = '],Msg)
329		; get_preference(maxNrOfEnablingsPerOperation,MO),
330		ajoin(['*** Not all transitions were computed as MAX_OPERATIONS=',MO,' was too small, e.g., for state with id = '],Msg)
331		),
332		Term=ID).
333		model_checking_is_incomplete(_FindInv,_FindDeadlocks,_FindGoal,_FindAss,Msg,Term) :-
334		(time_out_for_node(ID,Op,Reason) ->
335		functor(Reason,Func,_), % time_out or virtual_time_out
336		ajoin(['*** Not all transitions were computed due to a ', Func,', e.g., for ',Op, ' and state with id = '],Msg),
337		Term=ID).
338		model_checking_is_incomplete(_FindInv,_FindDeadlocks,_FindGoal,_FindAss,Msg,'') :-
339		get_preference(ignore_hash_collisions,true),
340		Msg = '*** Possibly not all states computed due to IGNORE_HASH_COLLISIONS preference'.
341
342		:- use_module(bmachine, [b_machine_has_proven_invariants/0, b_machine_has_unproven_assertions/0]).
343		proof_info_model_checking_incomplete(1,_FindDeadlocks,_FindGoal,0,Msg) :-
344		b_machine_has_proven_invariants,
345		preferences:get_preference(use_po,true),
346		b_machine_has_unproven_assertions,
347		Msg = '*** Using proof information (-p PROOF_INFO TRUE) is potentially incomplete when not checking theorems (-noass) !'.
348
349
350		% disable POR if not applicable + merge POR/PGE info into one atom for easier lookup in compute_transitions
351		initialise_optimisations(MODE,PartialOrderReduction,FindInvViolations,Optimisations) :-
352		MODE == b,
353		!,
354		((PartialOrderReduction == ample_sets; PartialOrderReduction == ample_sets2) ->
355		get_preference(enable_graph,UseEnableGraph),
356		get_preference(enable_graph_depth,Depth),
357		PORPrefs = por(PartialOrderReduction,UseEnableGraph,Depth,off),
358		Optimisations = opt(PORPrefs,off),
359		(FindInvViolations == 1 -> assertz(ample_sets:check_cycle_proviso);true)
360		;
361		Optimisations = opt(off,off)).
362		initialise_optimisations(_,_,_,opt(off,off)).
363
364
365		:- dynamic expired_static_analysis_time/1.
366		perform_static_analyses(MODE,FindInvViolations,opt(PORPrefs,_)) :-
367		MODE == b,
368		!,
369		retractall(expired_static_analysis_time(_)),
370		statistics(runtime,[T1,_]),
371		(perform_static_analyses_aux(PORPrefs,FindInvViolations) -> true
372		; add_internal_error('POR static analysis failed:',perform_static_analyses_aux(PORPrefs,FindInvViolations))
373		),
374		statistics(runtime,[T2,_]),
375		D is T2-T1,
376		assertz(expired_static_analysis_time(D)).
377		perform_static_analyses(_,_,_) :- retractall(expired_static_analysis_time(_)).
378
379		perform_static_analyses_aux(off,_FindInvViolations) :- !.
380		perform_static_analyses_aux(PORPrefs,FindInvViolations) :-
381		PORPrefs = por(POROption,_UseEnableGraph,_Depth,_),
382		(POROption==ample_sets;POROption==ample_sets2),!,
383		compute_dependendency_relation_of_all_events_in_the_model(FindInvViolations,PORPrefs,_EnableGraph).
384		perform_static_analyses_aux(_,_).