Modular Ranking Abstraction

Abstract

Predicate abstraction has become one of the most successful methodologies for proving safety properties of programs. Recently, several abstraction methodologies have been proposed for proving liveness properties. This paper studies "ranking abstraction" where a program is augmented by a non-constraining progress monitor based on a set of ranking functions, and further abstracted by predicate-abstraction, to allow for automatic verification of progress properties. Unlike many liveness methodologies, the augmentation does not require a complete ranking function that is expected to decrease with each helpful step. Rather, adequate user-provided inputs are component rankings from which a complete ranking function may be automatically formed. The premise of the paper is an analogy between the methods of ranking abstraction and predicate abstraction, one ingredient of which is refinement: When predicate abstraction fails, one can refine it. When ranking abstraction fails, one must determine whether the predicate abstraction, or the ranking abstraction, needs be refined. The paper presents strategies for determining which case is at hand, and methods for performing the apporpriate refinements. The other part of the analogy is that of automatically deriving deductive proof constructs: Predicate abstraction is often used to derive program invariants for proving safety properties as a boolean combination of the given predicates. Deductive proof of progress properties requires well-founded ranking functions in addition to invariants. We show how the constructs necessary for a deductive proof of an arbitrary LTL formula can be automatically extracted from a successful application of the ranking abstraction method.

Auxiliary Constructs for Proving Liveness in Compassion Discrete Systems

“…(1) use ranking abstraction [9,3,2] and construct D α and ψ α from D and ψ, and then construct a pending graph [2] based on D α . (2) construct an initial rank for each node (except the goal state) of the pending graph and a set of helpful compassion requirements associated to each of these nodes of the pending graph.…”

“…This step is carried out according to the technique of ranking abstraction [9,3,2] and pending graph [2].…”

“…The method was then extended to handle a large class of problems by relaxing restrictions requiring that the helpful assertions and ranking functions only depend on the local states of a process [7]. For dealing with ranking abstraction in proving liveness properties in systems with justice requirements, an approach is presented in [2] based on graph manipulation for generating helpful assertions and ranking functions.…”

“…Along this line of research, our approach presented in this paper extends that of [2] in order to be able to compute ranking functions for proving liveness properties in sequential and concurrent programs with compassion requirements including those introduced with ranking abstraction and those stated explicitly in the compassion discrete system. Our approach may as well be used for proving liveness properties with the use of predicate abstraction (when ranking abstraction does not provide additional useful compassion requirements).…”

“…They include helpful assertions and ranking functions defined on a well-founded domain. Along the line of the work [2] that computes ranking functions for response properties for systems with justice requirements, we develop an approach which extends that of [2] for computing ranking functions for systems with compassion requirements. We illustrate the use of the approach on three examples.…”