Extrapolating (omega-)regular model checking

Abstract

Omega-)Regular model checking is the name of a family of techniques in which states are represented by words, sets of states by finite automata on these objects, and transitions by finite automata operating on pairs of state encodings, i.e., finite-state transducers. In this context, the problem of computing the set of reachable states of a system can be reduced to the one of computing the iterative closure of the finite-state transducer representing its transition relation. In this tutorial article, we survey an extrapolation-based technique for computing the closure of a given transducer. The approach proceeds by comparing successive elements of a sequence of approximations of the iteration, detecting an "increment" that is added to move from one approximation to the next, and extrapolating the sequence by allowing arbitrary repetitions of this increment. The technique applies to finite-word and deterministic weak Büchi automata. Finally, we discuss the implementation of these results within the T(O)RMC toolsets and present case studies that show the advantages and the limits of the approach.

Regular model checking

“…Sets of configurations are now modeled by tree automata, while transition relations are represented by tree transducers. The paper is based on principles similar to those in [46], namely iteratively computing transitive closures of tree transducers, while enhancing the iterations by a widening operator. The method is applied to perform different tasks on various classes of systems such as the verification of parameterized tree networks, and data-flow analysis of multithreaded programs.…”

“…The papers included in this issue cover large parts of the topics mentioned above: -The paper [46] describes a widening technique for computing the transitive closure of a relation induced by a transducer. This is done by deriving a sequence of automata that represent successive approximations of the transitive closure.…”

“…A safety property that holds for the over-approximation holds also for the original system. Over-approximations are computed either by applying abstraction functions [25,37], or by applying widening techniques [27,46]. Typically, widening is achieved by first generating increasing sequences of approximations of the set of reachable states, then detecting an "increment" in the manner in which the set of detected states grows, and finally extrapolating by allowing an arbitrary repetition of the detected increment.…”

Regular Model Checking Upside-Down: An Invariant-Based Approach

“…Research on RMC has produced many acceleration, abstraction, and widening techniques to make the iterative computation "jump over the fixpoint" in finite time, and produce an invariant of the system not satisfied by any unsafe configuration (see e.g. [10,21,15,4,7,9,11,8,22,14]).…”

Enhancing Approximations for Regular Reachability Analysis

“…In this work only transducers representing the effect of a single application of a transition are considered, and consequently the reachability analysis does not terminate for a lot of protocols. To bypass this problem and still reach a fixpoint, the principal methods are acceleration (providing exact computations) [22,11,15,16,3,8], widening (extrapolating) [11,25,24], and automata abstraction [10]. Recently, new results in RMC have been obtained for specific protocols (i.e., CLP [19], communicating systems [20], tree language [1,12], or relational string verification using multi-track automata [26]), using domain-specific techniques [7].…”