Symmetry and Completeness in the Analysis of Parameterized Systems

Abstract

Abstract. Parameterized systems (e.g., network protocols) are compositions of a number of isomorphic, finite-state processes. While correctness is decidable for any fixed-size instance, correctness over all instances is undecidable in general. Typical proof methods, such as those based on process invariants or cutoffs, rely on summarizing the behavior of a parameterized system by a finite-state process. While these methods have been applied successfully to particular protocols, it is unknown whether such summarization is always possible. In this paper, it is shown that-after essential modifications-the cutoff method (which has the most stringent requirements) is complete for safety properties. The proof also shows that cutoff proofs are equivalent to determining inductive invariants. The paper studies this question next, presenting a new algorithm to construct universally quantified inductive invariants. The algorithm computes the strongest invariant of a given shape, and is therefore complete. The key to this result is a previously unnoticed connection between inductiveness, small model theorems, and compositional analysis, which is interesting in its own right.

All for the Price of Few

“…The same assumption is made in many landmark works on parameterized systems (e.g. [11,31,10,5,6,29,3]). However, actual implementations of global checks are usually not atomic.…”

“…Several works reduce parameterized verification to the verification of finite-state models. Among these, the invisible invariants method [6,31] and the work of [29] exploit cut-off properties to check invariants for mutual exclusion protocols. The success of the method depends on the heuristic used in the generation of the candidate invariant.…”

Block Me If You Can!

“…We introduce a standard model [31,13,6,30] of parameterized systems operating on a linear topology, where processes may perform local or global transitions. Formally, a parameterized system is a pair P = (Q, ∆) where Q is a finite set of process local states and ∆ is a set of transition rules over Q.…”

Invariants for finite instances and beyond

“…The main difference with our approach is that candidates are model checked one at a time in a completely independent resource limited backward reachability loop. Other approaches for generating inductive invariants include network invariants [21] which uses finite automata learning algorithms and split invariants [32] which connects small-model properties, inductive methods and compositional reasoning.…”