On model checking data-independent systems with arrays without reset

Abstract

A system is data-independent with respect to a data type X iff the operations it can perform on values of type X are restricted to just equality testing. The system may also store, input and output values of type X.We study model checking of systems which are data-independent with respect to two distinct type variables X and Y , and may in addition use arrays with indices from X and values from Y . Our main interest is the following parameterised model-checking problem: whether a given program satisfies a given temporal-logic formula for all non-empty finite instances of X and Y .Initially, we consider instead the abstraction where X and Y are infinite and where partial functions with finite domains are used to model arrays. Using a translation to data-independent systems without arrays, we show that the µ-calculus model-checking problem is decidable for these systems.From this result, we can deduce properties of all systems with finite instances of X and Y . We show that there is a procedure for the above parameterised model-checking problem of the universal fragment of the µ-calculus, such that it always terminates but may give false negatives. We also deduce that the parameterised model-checking problem of the universal disjunction-free fragment of the µ-calculus is decidable. Practical motivations for model checking data-independent systems with arrays include verification of memory and cache systems, where X is the type of memory addresses, and Y the type of storable values. As an example we verify a fault-tolerant memory interface over a set of unreliable memories.

Relating Data Independent Trace Checks in CSP with UNITY Reachability under a Normality Assumption

“…The Unity fragment used in [11,5] is a much simpler language than CSP. In essence, its programs consist of a finite set of variables, an initialisation of the variables, and a finite set of guarded multiple assignments of the form, boolean expression −→ {assignment}.…”

“…5 We note that this implies that in order to translate refinement questions like that of SpecNR to Unity, it is likely that arrays would be required in the Unity even if not in the CSP. normal form computed by FDR [14].…”

“…Our research has explored both of these [4,5] and we have formulated a unifying semantic framework to capture data independence [6,7].…”

“…Besides the obvious benefits of connecting and unifying different data independence theories, there are some other very important practical ones, since it means that results obtained in the Unity style may now apply to CSP. One particular class of result we want to borrow are our recent decidability results on DI arrays [11,5,12].…”

Genericity and the π-Calculus

“…Lazic, Nowak and Roscoe [15] show that when programs manipulate data abstractly (called data independence), a transition system with a parametricity property can be used for reasoning, leading to efficient model checking techniques. The generic labelled transition unifies, and in some cases strengthens, these ideas as dual aspects of a single framework.…”