Environment Abstraction for Parameterized Verification

Handling Parameterized Systems with Non-atomic Global Conditions

“…All existing automatic verification methods (e.g., [12,4,6,8,9,3,2]) are defined for parameterized systems where universal and existential conditions are evaluated atomically. Non-atomic versions of parameterized mutual exclusion protocols such as the Bakery algorithm and two-phase commit protocol have been studied with heuristics to discover invariants, ad-hoc abstractions, or semi-automated methods in [5,13,16,7].…”

“…All existing approaches to automatic verification of parameterized systems (e.g., [12,4,6,8]) make the unrealistic assumption that a global condition is performed atomically, i.e., the process which is about to make the transition checks the states of all the other processes and changes its own state, all in one step. However, almost all protocols (modeled as parameterized systems with global conditions) are implemented in a distributed manner, and therefore it is not feasible to test global conditions atomically.…”

Proving Ptolemy Right: The Environment Abstraction Framework for Model Checking Concurrent Systems

“…Thus, when we focus on a particular class of protocols like cache coherence protocols or mutual exclusion protocols, the protocols in that class can be described in terms of a small number of compound transactions or statements. For example, to describe cache coherence protocols we need at most six compound statements [25], to describe mutex protocols we need only two statements [6,25], and to describe semaphore based algorithms, we just need a single statement, cf. Sections 4 and 5.…”

“…In previous work, we used a specific instance of environment abstraction for the verification of the Bakery procotol and Szymanski's algorithm [6]. Although our paper [6] contains several seminal ideas about environment abstraction, it is very different in scope and generality.…”

“…Although our paper [6] contains several seminal ideas about environment abstraction, it is very different in scope and generality. In particular, the methods in [6] are tailored towards a specific application and a hardwired set of specifications, without a general soundness result.…”