Finite countermodels as invariants. A case study in verification of parameterized mutual exclusion protocol

Abstract

In [5,6] we proposed a simple but powerful approach to the verification of safety properties of parameterized and infinite state systems. Consider encoding e : s → ϕ s of states of a transition system S = S, → by formulae of first-order predicate logic satisfying the folowing property. The state s ′ is reachable from s, i.e. s → * s ′ if and only if ϕ s ′ is the logical consequence ofUnder such assumptions establishing reachability amounts to theorem proving, while deciding nonreachability, becomes theorem disproving. To verify a safety property, i.e non-reachability of unsafe states, it is sufficient to disprove a formula of the form φ → ψ. We proposed in [5,6] to delegate the latter task to generic finite model finding procedures for first-order predicate logic [3]. We show in [5] that the parallel composition of a complete finite model finder and a complete theorem prover is a decision procedure for safety properties of lossy channel systems [1] under appropriate encoding. Using a finite model finder Mace4 coupled with a theorem prover Prover9 [7] we successfully applied the method to the verification of alternating bit protocol, specified by a lossy channel system; all parameterized cache coherence protocols from [4]; series of coverability and reachability tasks for Petri Nets; parameterized Dining Philosophers Problem (DPP) and to parameterized linear systems (arrays) of finite automata. 1 When the safety is verified, the method produces a finite countermodel, which is a concise representation of a system invariant. We discuss the invariants produced for some of the mentioned examples, focussing on the one case study. This case study is the verification of parameterized mutual exclusion protocol, which was used as a running example in [2]. The protocol is specified as a parameterized system of finite automata arranged in the linear array.We conclude with a general claim of relative completeness of the proposed method with respect to the verification methods presented in [1,4,2]. In the ongoing work we aim to formally support this claim. References[1] Parosh Aziz Abdulla, Jonsson B. Verifying programs with unreliable channels.

Finite countermodels for safety verification of parameterized tree systems

“…This work continues the exploration of the FCM approach presented in [14,15,16,17,18,19]. In [17](which is an extended version of [15]) it was shown that FCM provides a decision procedure for safety verification for lossy channel systems, and that FCM can be used for efficient verification of parameterised cache coherence protocols.…”

“…In [17](which is an extended version of [15]) it was shown that FCM provides a decision procedure for safety verification for lossy channel systems, and that FCM can be used for efficient verification of parameterised cache coherence protocols. The relative completeness of the FCM with respect to regular model checking and methods based on monotonic abstraction for linear parameterized systems was established in [18](which is an extended version of the abstract [16]). The relative completeness of the FCM with respect to tree completion techniques for general term rewriting systems is shown in [19].…”