一、NuSMV的安装
a) http://nusmv.irst.itc.it/ 下载NuSMV。
b) 解压文件后,有cudd,minisat,zchaff和nusmv四个文件夹。
c) 安装nusmv前,先要安装sat求解器和cudd。
d) 由于MiniSAT(http://minisat.se/)的网页无法打开,所以,我们使用Zchaff(http://www.princeton.edu/~chaff/zchaff.html),下载zChaff 2007.3.12 32 bit version至zchaff文件夹中。
e) 修改zchaff-default.in文件:
zchaff_ver=2008.10.12
zchaff_zip=zchaff.$zchaff_ver.zip
zchaff_dir=zchaff
# ----------------------------------------------------------------------
#zchaff_patch=zchaff.64bit.${zchaff_ver}_nusmv.patch
zchaff_link=../zchaff_v${zchaff_ver}
zchaff_libname=sat
zchaff_ifcname=SAT_C.h
#patched_tag=patched_${zchaff_ver}
f) 在终端运行./build.sh。
g) cudd的安装:
i. sudo apt-get install flex
ii. sudo apt-get install bison
iii. 终端执行make。
h) nusmv的安装:
i. sudo apt-get install expat
ii. 在nusmv目录下:./configure --enable-zchaff,告诉nusmv使用的是zchaff。
iii. make
二、Candece SMV的安装
a) ubuntu系统使用的是bash,所以第五步的安装按红色的文字进行修改。
Cadence Berkeley Labs RESEARCH SOFTWARE registration form
SMV for i386/Linux
Step 1:
Download a binary distribution. The file name has the form smv.version.arch.tar.gz, where "arch" is your processor architecture and operating system.
Step 2:
Create a new directory for smv. We'll assume this dirctory is /usr/local/smv, but you can make it wherever you want. Don't try to put smv in a directory with anything else.
Step 3:
Unpack the smv distribution with a shell command like the following (using, of course, the name of the file you downloaded, and the directory you created):
gzip -c -d smv.MM-DD-YY.unknown_Linux_2.0.34.tar.gz | (cd /usr/local/smv;tar xf -)
Step 4:
Very important: Put /usr/local/smv/bin in your PATH variable, /usr/local/smv/man in your MANPATH variable, and /usr/local/smv/lib in your LD_LIBRARY_PATH variable. For example, if you use csh(bash), put the following at the end of your .cshrc(.bashrc) file:
setenv SMV_DIR /usr/local/smv (export SMV_DIR=”/usr/local/smv”)
setenv PATH $SMV_DIR/bin:$PATH (export PATH=”$SMV_DIR/bin:$PATH”)
setenv MANPATH $SMV_DIR/man:$MANPATH (export MANPATH= ”$SMV_DIR/man:$MANPATH”)
setenv LD_LIBRARY_PATH $SMV_DIR/lib:$LD_LIBRARY_PATH (export LD_LIBRARY_PATH=”$SMV_DIR/lib:$LD_LIBRARY_PATH”)
Step 5:
See the following man pages:
* smv (the command line version of smv)
* vw (the GUI version of smv)
Or, to get started, run the tutorial by using the command "smv_tutorial". To run the tutorial, you need "netscape" in your PATH.
b)
三、Eclipse的安装
a) 应用程序->添加/删除 安装Eclipse。
b) 安装SATABS插件:
1. Install Eclipse. You must use location that does not contain spaces in the path name. Note that you need Eclipse 3.2. The version 3.1 will not work.
2. Start Eclipse, open "Help" → "Software Updades" → "Find and Install"
3. Select "Search for new features to install", then "Next"
4. Click "New remote site", Name: "SATABS Plugin",
URL Linux: http://www.verify.ethz.ch/satabs/plugin/lin/
URL Windows: http://www.verify.ethz.ch/satabs/plugin/win/ URL OSX/Intel: http://www.verify.ethz.ch/satabs/plugin/osx/
5. Click "Finish"
6. Select "org.feature.CProver", then click "Next"
7. Read and accept the license (by clicking "Next"), then click on "Finish"
8. There will be a warning that the code is not digitally signed. Click "Install".
c) 汉化:
ii. 解压缩到/home/xul/SATABS目录下,eclipse文件。
iii. 打开eclipse,"Help" → "Software Updades" → "Find and Install",将/home/xul/SATABS/eclipse作为安装目录,对eclipse进行插件安装即可。
四、SATABS直接解压,得到可执行文件,命令行模式执行。
a) 解压/home/xul/software/SATABS/satabs-2-3-linux,得到satabs-2-3-linux_FILES,在该目录下执行./satabs即可。
五、作为Eclipse插件运行时,显示smv运行错误(有待解决),而命令行模式时则可正确运行。
六、运行实例:
a) 将driver中的文件全部拷入satabs所在的目录中。
b) ./satabs --show-claims driver.c spec.c
file driver.c: Parsing
file spec.c: Parsing
Converting
Type-checking driver
Type-checking spec
Generating GOTO Program
Removing function pointers
Full inlining
Pointer Analysis
Adding Pointer Checks
Invariant Propagation
Claim dummy_open.1:
file driver.c line 15 function dummy_open
i_rdev mismatch
TRUE
Claim unregister_chrdev.1:
file spec.c line 18 function unregister_chrdev
MOD_IN_USE in unregister_chrdev
FALSE
c) ./satabs --claim unreginster_chrdev.1 driver.c spec.c
file driver.c: Parsing
file spec.c: Parsing
Converting
Type-checking driver
Type-checking spec
Generating GOTO Program
Removing function pointers
Full inlining
Pointer Analysis
Adding Pointer Checks
Invariant Propagation
*** Starting CEGAR Loop ***
Calculating initial set of predicates
*** CEGAR Loop Iteration 1
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 49
Spurious counterexample.
Trace is spurious
Checking transitions
Refining set of predicates according to counterexample (WP)
*** CEGAR Loop Iteration 2
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 59
Spurious counterexample.
Trace is spurious
Checking transitions
Verified 0 original clauses.
Verified 44 original clauses.
Verified 35 original clauses.
Verified 0 original clauses.
Verified 35 original clauses.
Verified 0 original clauses.
Verified 70 original clauses.
Verified 105 original clauses.
Verified 105 original clauses.
Verified 316 original clauses.
Verified 81 original clauses.
Verified 123 original clauses.
Verified 35 original clauses.
Verified 68 original clauses.
*** CEGAR Loop Iteration 3
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 60
Spurious counterexample.
Trace is spurious
Checking transitions
Verified 378 original clauses.
Verified 0 original clauses.
*** CEGAR Loop Iteration 4
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 66
Spurious counterexample.
Trace is spurious
Checking transitions
Verified 118 original clauses.
Verified 114 original clauses.
Verified 352 original clauses.
Verified 114 original clauses.
Verified 114 original clauses.
Verified 81 original clauses.
Verified 124 original clauses.
Verified 118 original clauses.
Verified 114 original clauses.
Verified 352 original clauses.
Verified 114 original clauses.
Verified 114 original clauses.
Verified 103 original clauses.
Verified 103 original clauses.
Verified 92 original clauses.
Verified 92 original clauses.
Refining set of predicates according to counterexample (WP)
*** CEGAR Loop Iteration 5
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 85
Spurious counterexample.
Trace is spurious
Checking transitions
Verified 0 original clauses.
Verified 0 original clauses.
Verified 35 original clauses.
Verified 70 original clauses.
Verified 109 original clauses.
Verified 430 original clauses.
Verified 422 original clauses.
Verified 548 original clauses.
Verified 184 original clauses.
Verified 184 original clauses.
Verified 473 original clauses.
Verified 116 original clauses.
Verified 149 original clauses.
Verified 0 original clauses.
Verified 0 original clauses.
Verified 116 original clauses.
Verified 116 original clauses.
Verified 0 original clauses.
Verified 81 original clauses.
Verified 124 original clauses.
Verified 430 original clauses.
Verified 422 original clauses.
Verified 548 original clauses.
Verified 184 original clauses.
Verified 184 original clauses.
Verified 103 original clauses.
Verified 103 original clauses.
Verified 92 original clauses.
Verified 92 original clauses.
Verified 413 original clauses.
Verified 0 original clauses.
Verified 81 original clauses.
Verified 124 original clauses.
Verified 430 original clauses.
Verified 422 original clauses.
Verified 548 original clauses.
Verified 184 original clauses.
Verified 184 original clauses.
Verified 81 original clauses.
Verified 123 original clauses.
*** CEGAR Loop Iteration 6
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 85
Spurious counterexample.
Trace is spurious
Checking transitions
*** CEGAR Loop Iteration 7
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 85
Spurious counterexample.
Trace is spurious
Checking transitions
Verified 282 original clauses.
Refining set of predicates according to counterexample (WP)
*** CEGAR Loop Iteration 8
Computing Predicate Abstraction for Program
Running Cadence SMV: smv -force -sift
Cadence SMV produced counterexample
Simulating abstract counterexample on concrete program
Path slicing
Prefix of size 102
Verified 152 original clauses.
Simulation successful
Counterexample:
State 1 file modules.h line 6 thread 0
----------------------------------------------------
usecount=0 (00000000000000000000000000000000)
State 2 file driver.c line 3 thread 0
----------------------------------------------------
dummy_major=0 (00000000000000000000000000000000)
State 3 file driver.c line 4 thread 0
----------------------------------------------------
locked=0 (00000000000000000000000000000000)
State 4 file <built-in> line 12 thread 0
----------------------------------------------------
__CPROVER_alloc=(assignment removed)
State 5 file <built-in> line 13 thread 0
----------------------------------------------------
__CPROVER_alloc_size=(assignment removed)
State 6 file <built-in> line 19 thread 0
----------------------------------------------------
__CPROVER_rounding_mode=0 (00000000000000000000000000000000)
State 16 file spec.c line 34 function main thread 0
----------------------------------------------------
spec::main::1::lock_held=0 (00000000000000000000000000000000)
State 19 file spec.c line 8 function register_chrdev thread 0
----------------------------------------------------
spec::register_chrdev::major=0 (00000000000000000000000000000000)
State 21 file spec.c line 8 function register_chrdev thread 0
----------------------------------------------------
spec::register_chrdev::name=&"dummy"[0]
State 22 file spec.c line 8 function register_chrdev thread 0
----------------------------------------------------
usecount=0 (00000000000000000000000000000000)
State 24 file spec.c line 10 function register_chrdev thread 0
----------------------------------------------------
dummy_major=42 (00000000000000000000000000101010)
State 27 file spec.c line 37 function main thread 0
----------------------------------------------------
spec::main::1::inode={ .i_rdev=10752 }
State 29 file driver.c line 8 function init_module thread 0
----------------------------------------------------
locked=0 (00000000000000000000000000000000)
State 32 file spec.c line 42 function main thread 0
----------------------------------------------------
spec::main::1::my_file={ .f_mode=0, .f_pos=0 }
State 33 file spec.c line 43 function main thread 0
----------------------------------------------------
spec::main::1::my_file={ .f_mode=0, .f_pos=0 }
State 34 file spec.c line 47 function main thread 0
----------------------------------------------------
spec::main::1::random=1 (00000001)
State 39 file driver.c line 15 function dummy_open thread 0
----------------------------------------------------
driver::dummy_open::inode=&inode.i_rdev
State 41 file driver.c line 15 function dummy_open thread 0
----------------------------------------------------
driver::dummy_open::filp=&my_file.f_mode
State 42 file driver.c line 16 function dummy_open thread 0
----------------------------------------------------
usecount=1 (00000000000000000000000000000001)
State 45 file driver.c line 20 function dummy_open thread 0
----------------------------------------------------
locked=1 (00000000000000000000000000000001)
State 46 file driver.c line 22 function dummy_open thread 0
----------------------------------------------------
spec::main::1::rval=0 (00000000000000000000000000000000)
State 49 file spec.c line 55 function main thread 0
----------------------------------------------------
spec::main::1::lock_held=1 (00000000000000000000000000000001)
State 52 file spec.c line 47 function main thread 0
----------------------------------------------------
spec::main::1::random=1 (00000001)
State 57 file driver.c line 15 function dummy_open thread 0
----------------------------------------------------
driver::dummy_open::inode=&inode.i_rdev
State 59 file driver.c line 15 function dummy_open thread 0
----------------------------------------------------
driver::dummy_open::filp=&my_file.f_mode
State 60 file driver.c line 16 function dummy_open thread 0
----------------------------------------------------
usecount=2 (00000000000000000000000000000010)
State 62 file driver.c line 19 function dummy_open thread 0
----------------------------------------------------
spec::main::1::rval=-1 (11111111111111111111111111111111)
State 69 file spec.c line 47 function main thread 0
----------------------------------------------------
spec::main::1::random=3 (00000011)
State 76 thread 0
----------------------------------------------------
driver::dummy_release::inode=&inode.i_rdev
State 78 thread 0
----------------------------------------------------
driver::dummy_release::filp=&my_file.f_mode
State 80 file driver.c line 43 function dummy_release thread 0
----------------------------------------------------
usecount=1 (00000000000000000000000000000001)
State 81 file driver.c line 44 function dummy_release thread 0
----------------------------------------------------
locked=0 (00000000000000000000000000000000)
State 85 file spec.c line 63 function main thread 0
----------------------------------------------------
spec::main::1::lock_held=0 (00000000000000000000000000000000)
State 87 file spec.c line 47 function main thread 0
----------------------------------------------------
spec::main::1::random=0 (00000000)
State 98 file spec.c line 16 function unregister_chrdev thread 0
----------------------------------------------------
spec::unregister_chrdev::major=42 (00000000000000000000000000101010)
State 100 file spec.c line 16 function unregister_chrdev thread 0
----------------------------------------------------
spec::unregister_chrdev::name=&"dummy"[0]
Violated property:
file spec.c line 18 function unregister_chrdev
MOD_IN_USE in unregister_chrdev
FALSE
VERIFICATION FAILED
Time: 2.16 total, 0.251 abstractor, 1.441 model checker, 0.088 simulator, 0.312 refiner
Iterations: 8
Predicates: 13
xul@xul-desktop:~/software/SATABS/satabs-2-3-linux_F