Liveness by Invisible Invariants

In this paper, we describe a method for synthesizing inductive invariants for cyberphysical aerospace systems that are parameterized on the number of participants, such as the number of aircraft involved in a coordinated maneuver. The methodology is useful for automating the traditionally manual process of deductive verification of safety properties, such as collision avoidance, and establishes such properties regardless of the number of participants involved in a protocol. We illustrate the methodology using a simplified model of the landing protocol of the Small Aircraft Transportation System (SATS) as a case study. Each participant (aircraft) in the protocol is modeled as a hybrid automaton with both discrete and continuous states and potentially nondeterministic evolution thereof. Discrete states change instantaneously according to transitions and continuous states evolve according to rectangular differential inclusions. The invariant synthesis method enables a fully automatic verification of the main safety property of SATS, namely, safe separation of aircraft on approach to the runway. The method is implemented in a prototype verification tool called Passel. We present promising experimental results using the methodology, which has enabled a fully automatic proof of safe separation for the model of SATS.

show abstract

“…Alternatively, the class of properties under consideration could be expanded, such as to stability or liveness properties. 13…”

Section: Discussionmentioning

confidence: 99%

Invariant Synthesis for Verification of Parameterized Cyber-Physical Systems with Applications to Aerospace Systems

Johnson

Mitra

2013

AIAA Infotech@Aerospace (I@A) Conference

View full text Add to dashboard Cite

show abstract

“…This approach can be used to verify a number of systems [13,18,8]. The sound but incomplete approaches include methods based on synthesis of invisible invariant (e.g., [10]); methods based on network invariant (e.g., [21]) that relies on the effectiveness of a generated invariant and the invariant refinement techniques; regular model checking [19] that requires acceleration techniques. Verification of liveness properties under fairness constraints have been studied in [15,17,20].…”

Section: Discussion and Related Workmentioning

confidence: 99%

Fair Model Checking with Process Counter Abstraction

Sun

Liu

Roychoudhury

et al. 2009

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Parameterized systems are characterized by the presence of a large (or even unbounded) number of behaviorally similar processes, and they often appear in distributed/concurrent systems. A common state space abstraction for checking parameterized systems involves not keeping track of process identifiers by grouping behaviorally similar processes. Such an abstraction, while useful, conflicts with the notion of fairness. Because process identifiers are lost in the abstraction, it is difficult to ensure fairness (in terms of progress in executions) among the processes. In this work, we study the problem of fair model checking with process counter abstraction. Even without maintaining the process identifiers, our on-the-fly checking algorithm enforces fairness by keeping track of the local states from where actions are enabled / executed within an execution trace. We enhance our home-grown PAT model checker with the technique and show its usability via the automated verification of several real-life protocols.

show abstract

“…These works share common goals with our work (and some also first-order logic), but are mostly orthogonal to the topic of our work, which is the reduction of liveness to safety. [Fang et al 2006] prove liveness properties of parameterized systems by a liveness-to-safety reduction, and by applying the method of invisible invariants [Pnueli et al 2001] to prove the resulting safety properties. They handle łbounded responsež properties of the form □ (q → ♢ r ), where a global bound exists on the number of rounds between q and r .…”

Section: Related Workmentioning

confidence: 99%

Reducing liveness to safety in first-order logic

Padon

Hoenicke

Losa

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We develop a new technique for verifying temporal properties of infinite-state (distributed) systems. The main idea is to reduce the temporal verification problem to the problem of verifying the safety of infinite-state systems expressed in first-order logic. This allows to leverage existing techniques for safety verification to verify temporal properties of interesting distributed protocols, including some that have not been mechanically verified before. We model infinite-state systems using first-order logic, and use first-order temporal logic (FO-LTL) to specify temporal properties. This general formalism allows to naturally model distributed systems, while supporting both unbounded-parallelism (where the system is allowed to dynamically create processes), and infinite-state per process. The traditional approach for verifying temporal properties of infinite-state systems employs well-founded relations (e.g. using linear arithmetic ranking functions). In contrast, our approach is based the idea of fair cycle detection. In finite-state systems, temporal verification can always be reduced to fair cycle detection (a system contains a fair cycle if it revisits a state after satisfying all fairness constraints). However, with both infinitely many states and infinitely many fairness constraints, a straightforward reduction to fair cycle detection is unsound. To regain soundness, we augment the infinite-state transition system by a dynamically computed finite set, that exploits the locality of transitions. This set lets us define a form of fair cycle detection that is sound in the presence of both infinitely many states, and infinitely many fairness constraints. Our approach allows a new style of temporal verification that does not explicitly involve ranking functions. This fits well with pure first-order verification which does not explicitly reason about numerical values. In particular, it can be used with effectively propositional first-order logic (EPR), in which case checking verification conditions is decidable. We applied our technique to verify temporal properties of several interesting protocols. To the best of our knowledge, we have obtained the first mechanized liveness proof for both TLB Shootdown, and Stoppable Paxos. CCS Concepts: • Theory of computation → Logic and verification; Modal and temporal logics; • Software and its engineering → Formal methods;

show abstract

Liveness by Invisible Invariants

Cited by 9 publications

References 21 publications

Invariant Synthesis for Verification of Parameterized Cyber-Physical Systems with Applications to Aerospace Systems

Invariant Synthesis for Verification of Parameterized Cyber-Physical Systems with Applications to Aerospace Systems

Fair Model Checking with Process Counter Abstraction

Reducing liveness to safety in first-order logic

Contact Info

Product

Resources

About