Ideal Abstractions for Well-Structured Transition Systems

Abstract

Abstract. Many infinite state systems can be seen as well-structured transition systems (WSTS), i.e., systems equipped with a well-quasi-ordering on states that is also a simulation relation. WSTS are an attractive target for formal analysis because there exist generic algorithms that decide interesting verification problems for this class. Among the most popular algorithms are acceleration-based forward analyses for computing the covering set. Termination of these algorithms can only be guaranteed for flattable WSTS. Yet, many WSTS of practical interest are not flattable and the question whether any given WSTS is flattable is itself undecidable. We therefore propose an analysis that computes the covering set and captures the essence of acceleration-based algorithms, but sacrifices precision for guaranteed termination. Our analysis is an abstract interpretation whose abstract domain builds on the ideal completion of the well-quasi-ordered state space, and a widening operator that mimics acceleration and controls the loss of precision of the analysis. We present instances of our framework for various classes of WSTS. Our experience with a prototype implementation indicates that, despite the inherent precision loss, our analysis often computes the precise covering set of the analyzed system.

Structural Counter Abstraction

“…2. This invariant (obtained, e.g., via [26]) is a finite set of nested graphs and is an over-approximation of the reachable states of the system. G 1 describes states in which spawning may still occur (indicated with a spawn vertex) and G 2 describes states in which spawning has ceased (indicated with a nwaps vertex) and arbitrarily many clients have performed Prepare, Suceed or Fail.…”

“…We systematically construct the structural counter abstraction of R from an inductive invariant of R. However, we are not interested in arbitrary inductive invariants but in those that are downward-closed with respect to graph embedding. Since graph embedding is a wqo on depth-bounded graphs, such downward-closed sets are finite unions of ideals of the embedding order [26]. Each ideal can itself be finitely represented and we can compute symbolically the effect of transition on this representation.…”

“…Unfortunately, this set is in general not computable for depth-bounded systems 3 , even though the covering problem 4 is decidable [25]. However, we can employ existing algorithms [26] that compute downwardclosed inductive approximations of the covering set. In practice, these algorithms often yield precisely Cover(T (R)).…”

“…The benefit of our approach is that it can utilize existing reachability analyses for depth-bounded systems to obtain the inductive invariant [26], and existing termination analyses for numerical programs [5,21]. We have implemented our method in a prototype tool and applied it to prove liveness properties of various concurrent systems, including nonblocking algorithms such as Treiber's stack, as well as distributed processes.…”

The Theory of WSTS: The Case of Complete WSTS

“…It has been also proved that, unlike backward algorithms (which solve coverability without computing the clover), the Expand, Enlarge and Check forward algorithm of [GRvB07], which operates on complete WSTS, solves coverability by computing a sufficient part of the clover, even though the depth of the process is not known a priori [WZH10]. Recently, Zufferey, Wies and Henzinger proposed to compute a part of the clover by using a particular widening, called a set-widening operator [ZWH12], which loses some information, but always terminates and seems sufficiently precise to compute the clover in various case studies.…”