LORETO: a tool for reducing state explosion in verification of LOTOS programs

Abstract

LOTOS is a formal specification language for concurrent and distributed systems. Basic LOTOS is the version of LOTOS without value-passing. A widely used approach to the verification of temporal properties is model checking. Often, in this approach the formal specification is translated into a labeled transition system on which formulae expressing properties are checked. A problem with this verification technique is state explosion: concurrent systems are often represented by automata with a prohibitive number of states. In this paper we show how, given a set ρ of actions, it is possible to automatically obtain for a Basic LOTOS program a reduced transition system to which only the arcs labeled by actions in ρ belong. The set ρ of actions plays a fundamental role in conjunction with a temporal logic defined by the authors in a previous paper: selective mu-calculus. The reduced system with respect to ρ preserves the truth value of all selective mu-calculus formulae with actions from the set ρ. We act at both syntactic and semantic levels. From a syntactic point of view, we define a set of transformation rules obtaining a smaller program. On the semantic side, we define a non-standard semantics which dynamically reduces the transition system during generation. We present a tool implementing both the syntactic and the semantic reduction. R. BARBUTI ET AL.systems, the properties concern eventuality or necessity constraints on the occurrence of the events of the system. Temporal logic has been defined to express this kind of properties: it extends classical logic with eventuality and necessity operators.The LOTOS language (Language Of Temporal Ordering Specification) [1] is a Formal Description Technique standardized by the International Standards Organizations (ISO). It can be used in the specification of concurrent and distributed systems, since it contains synchronization, communication and parallelism as primitive notions. It is based on an algebraic theory of concurrency, allowing us to express equivalence notions and system properties. Basic LOTOS is the version of LOTOS without value-passing; thus it is used to describe the synchronization aspects of the system. Basic LOTOS is particularly well suited for the specification of protocols, since in these systems data are not the main concern, while message exchange is crucial.Many verification environments exist for LOTOS and LOTOS-like languages [2-8] offering tools both for checking equivalences and for verifying properties. These environments differ from each other in the specification languages and in the temporal logic that can be used to express properties. One of the most popular environments is the Concurrency Workbench of North Carolina (CWB-NC) [4,8], which includes several different specification languages, among which are Basic LOTOS and CCS [9]. The specifications can be checked for different equivalences, and different logics can be used to express properties. Moreover, diagnostic information is provided, to locate faults.In the CWB-NC, as well as in...

Reduced Models for Efficient CCS Verification

“…The compacting rules, as those ones described in [3], try to eliminate the sum operator, which may be cause of state explosion when occurring in a parallel context. This is accomplished by deleting redundant branches of sums which differ only for their first action not belonging to ρ:…”

“…Similar transformations have been defined in [3] for LOTOS processes. In this paper we propose an action deleting rule which is more powerful.…”

“…The following theorem states the correctness of the rules in Table 1: Let us now show the difference between the action deleting rule proposed in this paper and that one proposed in [3]. To overcome the problems concerning the indication of the first action of a sum within the scope of a parallel composition (solved in this paper with the notions of context and marked term) in [3] has been proposed a very simple action deleting rule: given a set of actions ρ, the rule deletes an action not in ρ only if it is preceded by another action.…”

“…The model checkers of the CWB-NC environment can be used to check selective mu-calculus formulae, since they can be easily translated into the temporal logic mucalculus, available in the Concurrency Workbench. In [3] we defined a similar approach for managing LOTOS [8] programs. There the approach was only informally presented: here the syntactic reduction and the non-standard semantics are formally defined and proved correct.…”

“…There the approach was only informally presented: here the syntactic reduction and the non-standard semantics are formally defined and proved correct. Moreover, the syntactic reduction used in this work is more powerful and complex than that defined in [3], and allows greater reductions. A main point of the paper is the development of a non-trivial case study, the Bounded Retransmission Protocol used by the Philips Company in one of its products [25][26][27].…”