Automatic Synthesis of Assumptions for Compositional Model Checking

Abstract

Abstract. We present a new technique for automatically synthesizing the assumptions needed in compositional model checking. The compositional approach reduces the proof that a property is satisfied by the parallel composition of two processes to the simpler argument that the property is guaranteed by one process provided that the other process satisfies an assumption A. Finding A manually is a difficult task that requires detailed insight into how the processes cooperate to satisfy the property. Previous methods to construct A automatically were based on the learning algorithm L * , which represents A as a deterministic automaton and therefore has exponential worst-case complexity. Our new technique instead represents A as an equivalence relation on the states, which allows for a quasi-linear construction. The model checker can therefore apply compositional reasoning without risking an exponential penalty for computing A.

Synthesising certificates in networks of timed automata

“…Given two Promela processes M, N and a property automaton P, our tool RESY [15,12] performs a graph-theoretic analysis of the product of N and P to identify states in M that can safely be merged. For timed systems, a graph-theoretical analysis alone is, of course, not sound, because one location may be safe and another unsafe, even if both have a (discrete) path to an error location.…”

Synthesizing Certificates in Networks of Timed Automata

“…Given two Promela processes M, N and a property automaton P, our tool RESY [13,12] performs a graphtheoretic analysis of the product of N and P to identify states in M that can safely be merged. For timed systems, a graph-theoretical analysis alone is, of course, not sound, because one location may be safe and another unsafe, even if both have a (discrete) path to an error location.…”

RESY: Requirement Synthesis for Compositional Model Checking

“…RESY implements the requirement synthesis algorithm presented in [4]. Given a system M E, which consists of a process M and its environment E, RESY computes an equivalence relation on the states of M , collapsing two states if E can either force the occurrence of an error from both states or from nei-⋆…”

“…Requirement automata represent the assumptions an environment makes on the behavior of a component. Typical applications include program documentation [1], where the synthesized requirements help the user to understand the interaction of the program components; program certification [2], where the synthesized requirements simplify the re-verification of the system (possibly by a different user and a different tool); and compositional model checking [3], where the requirement is synthesized and used during the same model checking run, in order to avoid the construction of the full product state space.RESY implements the requirement synthesis algorithm presented in [4]. Given a system M E, which consists of a process M and its environment E, RESY computes an equivalence relation on the states of M , collapsing two states if E can either force the occurrence of an error from both states or from nei-⋆…”