Proceedings 11th Annual IEEE Symposium on Logic in Computer Science
Partial-order methods make it possible to check properties of a concurrent system by state-space ... more Partial-order methods make it possible to check properties of a concurrent system by state-space exploration without considering all interleavings of independent concurrent events. They have been applied to linear-time model checking, but so far only limited results are known about their applicability to branching-time model checking. In this paper, we introduce a general technique for lifting partial-order methods from linear-time to branching-time logics. This technique is shown to be applicable both to reductions that are applied to the structure representing the program before running the model checking procedure, as well as to reductions that can be obtained when model checking is done in an automata-theoretic framework. The latter are extended to branching-time logics by using the model-checking framework based on alternating automata introduced by Bernholtz, Vardi and Wolper.
This paper addresses the problem of verifying programs for the relaxed memory models implemented ... more This paper addresses the problem of verifying programs for the relaxed memory models implemented in modern processors. Specifically, it considers the TSO (Total Store Order) relaxation, which corresponds to the use of store buffers. The proposed approach proceeds by using finite automata to symbolically represent the possible contents of the store buffers. Store, load and commit operations then correspond to operations on these finite automata. The advantage of this approach is that it operates on (potentially infinite) sets of buffer contents, rather than on individual buffer configurations. This provides a way to tame the explosion of the number of possible buffer configurations, while preserving the full generality of the analysis. It is thus possible to check even designs that exploit the relaxed memory model in unusual ways. An experimental implementation has been used to validate the feasibility of the approach.
This paper presents a tutorial introduction to the construction of finite-automata on infinite wo... more This paper presents a tutorial introduction to the construction of finite-automata on infinite words from linear-time temporal logic formulas. After defining the source and target formalisms, it describes a first construction whose correctness is quite direct to establish, but whose behavior is always equal to the worst-case upper bound. It then turns to the techniques that can be used to improve this algorithm in order to obtain the quite effective algorithms that are now in use. This work was partially funded by a grant of the "Communauté française de Belgique-Direction de la recherche scientifique-Actions de recherche concertées".
Thanks to the development of a number of efficiency enhancing techniques, state-space exploration... more Thanks to the development of a number of efficiency enhancing techniques, state-space exploration based verification, and in particular model checking, has been quite successful for finite-state systems. This has prompted efforts to apply a similar approach to systems with infinite state spaces. Doing so amounts to developing algorithms for computing a symbolic representation of the infinite state space, as opposed to requiring the user to characterize the state space by assertions. Of course, in most cases, this can only be done at the cost of forgoing any general guarantee of success. The goal of this paper is to survey a number of results in this area and to show that a surprisingly common characteristic of the systems that can be analyzed with this approach is that their state space can be represented as a regular language.
Linear numerical constraints and their first-order theory, whether defined over the reals or the ... more Linear numerical constraints and their first-order theory, whether defined over the reals or the integers, are basic tools that appear in many areas of Computer Science. This paper overviews a set of techniques based on finite automata that lead to decision procedures and other useful algorithms, as well as to a normal form, for the first-order linear theory of the integers, of the reals, and of the integers and reals combined. This approach has led to an implemented tool, which has the so far unique capability of handling the linear first-order theory of the integers and reals combined.
Proceedings of the sixteenth annual ACM symposium on Principles of distributed computing - PODC '97, 1997
This paper is motivated by the fact that verifying liveness properties under a fairness condition... more This paper is motivated by the fact that verifying liveness properties under a fairness condition is often problematic, especially when abstraction is used. It shows that using a more abstract notion than truth under fairness, specifically the concept of relative liveness property can lead to interesting possibilities. Technically, it is first established that deciding relative liveness is a PSPACE-complete problem and it is shown that relative liveness properties ca aiways be satisfied by some fair implementation. Thereafter, the interaction between behavior abstraction and relative Iiveness properties is studied and it is proved that relative liveness properties can be verified on behavior abstractions, if the abstracting homomorphism is simple in the sense of Ochsenschlager. Keywords. Verification, Relative Liveness Properties, Behavior Abstraction, Simple Homomorphisms. " Ulrich Nitsche was supported by a DA AD-fellowship HSP 11/AUFE to visit the University of Li&ge. Parts of this work have been done during his visit. He is supported by the Swiss National Science Foundation (SNSF). permission to make digital/lxwd copies o!' 011or PM of Ibis nmterial for pemnal or chu+sroom use is granted without fee provided lb~l tht copies are not mde or distributed for protit or commercial iwiwmtmge, lIw copyright nolice. the title of the publication md its dirte appmr. and notice is given thnt copyright is hy permission of the M'hl, Inc.10 cow olberwiw, to re"~lblidl, 10 post On sewersor 10 redis!ributc LOlists, requires specitic petiiwion antiw fee 1997 F'OIX"'97 .Sflrrto Borhrn ('.4 i FM
This paper considers finite-automata based algorithms for handling linear arithmetic with both re... more This paper considers finite-automata based algorithms for handling linear arithmetic with both real and integer variables. Previous work has shown that this theory can be dealt with by using finite automata on infinite words, but this involves some difficult and delicate to implement algorithms. The contribution of this paper is to show, using topological arguments, that only a restricted class of automata on infinite words are necessary for handling real and integer linear arithmetic. This allows the use of substantially simpler algorithms and opens the path to the implementation of a usable system for handling this combined theory. ⋆ This work was partially funded by a grant of the "Communauté française de Belgique-Direction de la recherche scientifique-Actions de recherche concertées".
This paper introduces a finite-automata based representation of Presburger arithmetic definable s... more This paper introduces a finite-automata based representation of Presburger arithmetic definable sets of integer vectors. The representation consists of concurrent automata operating on the binary encodings of the elements of the represented sets. This representation has several advantages. First, being automata-based it is operational in nature and hence leads directly to algorithms, for instance all usual operations on sets of integer vectors translate naturally to operations on automata. Second, the use of concurrent automata makes it compact. Third, it is insensitive to the representation size of integers. Our representation can be used whenever arithmetic constraints are needed. To illustrate its possibilities we show that it can handle integer programming optimally, and that it leads to a new original algorithm for the satisfiability of arithmetic inequalities.
Queue-content Decision Diagrams (QDDs) are finite-automaton based data structures for representin... more Queue-content Decision Diagrams (QDDs) are finite-automaton based data structures for representing (possibly infinite) sets of contents of a finite collection of unbounded FIFO queues. Their intended use is to serve as a symbolic representation of the possible queue contents that can occur in the state space of a protocol modeled by finite-state machines communicating through unbounded queues. This is done with the help of a loop-first search, a state-space exploration technique that attempts whenever possible to compute symbolically the effect of repeatedly executing a loop any number of times, making it possible to analyze protocols with infinite state spaces though without the guarantee of termination. This paper first solves a key problem concerning the use of QDDs in this context: it precisely characterizes when, and shows how, the operations required by a loop-first search can be applied to QDDs. Then, it addresses the problem of exploiting QDDs and loop-first searches to broaden the range of properties that can be checked from simple state reachability to temporal logic. Finally, a sufficient criterion for the termination of a loop-first search using QDDs is given.
24th Annual Symposium on Foundations of Computer Science (sfcs 1983), 1983
We investigate extensions of tenlporal logic by finite automata on infinite words. There are thre... more We investigate extensions of tenlporal logic by finite automata on infinite words. There are three different types of acceptance conditions (finite, looping and repeating) that one can give for these finite automata. This gives rise to three different logics. It turns out, ho\vever. that these logics have the same expressive po\ver but differ in the complexity of their decision problem. V/e also investigate the addition of alternation and sho\v that it does not increase the complexity of the decision problem.
International Journal of Foundations of Computer Science, 2009
This paper considers the problem of computing the real convex hull of a finite set of n-dimension... more This paper considers the problem of computing the real convex hull of a finite set of n-dimensional integer vectors. The starting point is a finite-automaton representation of the initial set of vectors. The proposed method consists in computing a sequence of automata representing approximations of the convex hull and using extrapolation techniques to compute the limit of this sequence. The convex hull can then be directly computed from this limit in the form of an automaton-based representation of the corresponding set of real vectors. The technique is quite general and has been implemented.
In computer system design, we distinguish between closed and open systems. A closed system is a s... more In computer system design, we distinguish between closed and open systems. A closed system is a system whose behavior is completely determined by the state of the system. An open system is a system that interacts with its environment and whose behavior depends on this interaction. The ability of temporal logics to describe an ongoing interaction of a reactive program with its environment makes them particularly appropriate for the specication of open systems. Nevertheless, model-checking algorithms used for the veri cation of closed systems are not appropriate for the veri cation of open systems. Correct model checking of open systems should check the system with respect to arbitrary environments and should take into account uncertainty regarding the environment. This is not the case with current model-checking algorithms and tools. In this paper we introduce and examine the problem of model checking of open systems (module checking, for short). We show that while module checking and model checking coincide for the linear-time paradigm, module checking is much harder than model checking for the branching-time paradigm. We prove that the problem of module checking is EXPTIMEcomplete for speci cations in CTL and is 2EXPTIME-complete for speci cations in CTL ?. This bad news is also carried over when we consider the program-complexity of module checking. As good news, we show that for the commonly-used fragment of CTL (universal, possibly, and always possibly properties), current model-checking tools do work correctly, or can be easily adjusted to work correctly, with respect to both closed and open systems.
This paper addresses the problem of designing memory-efficient algorithms for the verification of... more This paper addresses the problem of designing memory-efficient algorithms for the verification of temporal properties of finite-state programs. Both the programs and their desired temporal properties are modeled as automata on infinite words (Büchi automata). Verification is then reduced to checking the emptiness of the automaton resulting from the product of the program and the property. This problem is usually solved by computing the strongly connected components of the graph representing the product automaton. Here, we present algorithms which solve the emptiness problem without explicitly constructing the strongly connected components of the product graph. By allowing the algorithms to err with some probability, we can implement them with a randomly accessed memory of size O(n) bits, where n is the number of states of the graph, instead of O(n log n) bits that the presently known algorithms require.
This paper presents an algorithm for detecting deadlocks in concurrent finite-state systems witho... more This paper presents an algorithm for detecting deadlocks in concurrent finite-state systems without incurring most of the state explosion due to the modeling of concurrency by interleaving. For systems that have a high level of concurrency our algorithm can be much more efficient than the classical exploration of the whole state space. Finally, we show that our algorithm can also be used for verifying arbitrary safety properties.
Proceedings 11th Annual IEEE Symposium on Logic in Computer Science
Partial-order methods make it possible to check properties of a concurrent system by state-space ... more Partial-order methods make it possible to check properties of a concurrent system by state-space exploration without considering all interleavings of independent concurrent events. They have been applied to linear-time model checking, but so far only limited results are known about their applicability to branching-time model checking. In this paper, we introduce a general technique for lifting partial-order methods from linear-time to branching-time logics. This technique is shown to be applicable both to reductions that are applied to the structure representing the program before running the model checking procedure, as well as to reductions that can be obtained when model checking is done in an automata-theoretic framework. The latter are extended to branching-time logics by using the model-checking framework based on alternating automata introduced by Bernholtz, Vardi and Wolper.
This paper addresses the problem of verifying programs for the relaxed memory models implemented ... more This paper addresses the problem of verifying programs for the relaxed memory models implemented in modern processors. Specifically, it considers the TSO (Total Store Order) relaxation, which corresponds to the use of store buffers. The proposed approach proceeds by using finite automata to symbolically represent the possible contents of the store buffers. Store, load and commit operations then correspond to operations on these finite automata. The advantage of this approach is that it operates on (potentially infinite) sets of buffer contents, rather than on individual buffer configurations. This provides a way to tame the explosion of the number of possible buffer configurations, while preserving the full generality of the analysis. It is thus possible to check even designs that exploit the relaxed memory model in unusual ways. An experimental implementation has been used to validate the feasibility of the approach.
This paper presents a tutorial introduction to the construction of finite-automata on infinite wo... more This paper presents a tutorial introduction to the construction of finite-automata on infinite words from linear-time temporal logic formulas. After defining the source and target formalisms, it describes a first construction whose correctness is quite direct to establish, but whose behavior is always equal to the worst-case upper bound. It then turns to the techniques that can be used to improve this algorithm in order to obtain the quite effective algorithms that are now in use. This work was partially funded by a grant of the "Communauté française de Belgique-Direction de la recherche scientifique-Actions de recherche concertées".
Thanks to the development of a number of efficiency enhancing techniques, state-space exploration... more Thanks to the development of a number of efficiency enhancing techniques, state-space exploration based verification, and in particular model checking, has been quite successful for finite-state systems. This has prompted efforts to apply a similar approach to systems with infinite state spaces. Doing so amounts to developing algorithms for computing a symbolic representation of the infinite state space, as opposed to requiring the user to characterize the state space by assertions. Of course, in most cases, this can only be done at the cost of forgoing any general guarantee of success. The goal of this paper is to survey a number of results in this area and to show that a surprisingly common characteristic of the systems that can be analyzed with this approach is that their state space can be represented as a regular language.
Linear numerical constraints and their first-order theory, whether defined over the reals or the ... more Linear numerical constraints and their first-order theory, whether defined over the reals or the integers, are basic tools that appear in many areas of Computer Science. This paper overviews a set of techniques based on finite automata that lead to decision procedures and other useful algorithms, as well as to a normal form, for the first-order linear theory of the integers, of the reals, and of the integers and reals combined. This approach has led to an implemented tool, which has the so far unique capability of handling the linear first-order theory of the integers and reals combined.
Proceedings of the sixteenth annual ACM symposium on Principles of distributed computing - PODC '97, 1997
This paper is motivated by the fact that verifying liveness properties under a fairness condition... more This paper is motivated by the fact that verifying liveness properties under a fairness condition is often problematic, especially when abstraction is used. It shows that using a more abstract notion than truth under fairness, specifically the concept of relative liveness property can lead to interesting possibilities. Technically, it is first established that deciding relative liveness is a PSPACE-complete problem and it is shown that relative liveness properties ca aiways be satisfied by some fair implementation. Thereafter, the interaction between behavior abstraction and relative Iiveness properties is studied and it is proved that relative liveness properties can be verified on behavior abstractions, if the abstracting homomorphism is simple in the sense of Ochsenschlager. Keywords. Verification, Relative Liveness Properties, Behavior Abstraction, Simple Homomorphisms. " Ulrich Nitsche was supported by a DA AD-fellowship HSP 11/AUFE to visit the University of Li&ge. Parts of this work have been done during his visit. He is supported by the Swiss National Science Foundation (SNSF). permission to make digital/lxwd copies o!' 011or PM of Ibis nmterial for pemnal or chu+sroom use is granted without fee provided lb~l tht copies are not mde or distributed for protit or commercial iwiwmtmge, lIw copyright nolice. the title of the publication md its dirte appmr. and notice is given thnt copyright is hy permission of the M'hl, Inc.10 cow olberwiw, to re"~lblidl, 10 post On sewersor 10 redis!ributc LOlists, requires specitic petiiwion antiw fee 1997 F'OIX"'97 .Sflrrto Borhrn ('.4 i FM
This paper considers finite-automata based algorithms for handling linear arithmetic with both re... more This paper considers finite-automata based algorithms for handling linear arithmetic with both real and integer variables. Previous work has shown that this theory can be dealt with by using finite automata on infinite words, but this involves some difficult and delicate to implement algorithms. The contribution of this paper is to show, using topological arguments, that only a restricted class of automata on infinite words are necessary for handling real and integer linear arithmetic. This allows the use of substantially simpler algorithms and opens the path to the implementation of a usable system for handling this combined theory. ⋆ This work was partially funded by a grant of the "Communauté française de Belgique-Direction de la recherche scientifique-Actions de recherche concertées".
This paper introduces a finite-automata based representation of Presburger arithmetic definable s... more This paper introduces a finite-automata based representation of Presburger arithmetic definable sets of integer vectors. The representation consists of concurrent automata operating on the binary encodings of the elements of the represented sets. This representation has several advantages. First, being automata-based it is operational in nature and hence leads directly to algorithms, for instance all usual operations on sets of integer vectors translate naturally to operations on automata. Second, the use of concurrent automata makes it compact. Third, it is insensitive to the representation size of integers. Our representation can be used whenever arithmetic constraints are needed. To illustrate its possibilities we show that it can handle integer programming optimally, and that it leads to a new original algorithm for the satisfiability of arithmetic inequalities.
Queue-content Decision Diagrams (QDDs) are finite-automaton based data structures for representin... more Queue-content Decision Diagrams (QDDs) are finite-automaton based data structures for representing (possibly infinite) sets of contents of a finite collection of unbounded FIFO queues. Their intended use is to serve as a symbolic representation of the possible queue contents that can occur in the state space of a protocol modeled by finite-state machines communicating through unbounded queues. This is done with the help of a loop-first search, a state-space exploration technique that attempts whenever possible to compute symbolically the effect of repeatedly executing a loop any number of times, making it possible to analyze protocols with infinite state spaces though without the guarantee of termination. This paper first solves a key problem concerning the use of QDDs in this context: it precisely characterizes when, and shows how, the operations required by a loop-first search can be applied to QDDs. Then, it addresses the problem of exploiting QDDs and loop-first searches to broaden the range of properties that can be checked from simple state reachability to temporal logic. Finally, a sufficient criterion for the termination of a loop-first search using QDDs is given.
24th Annual Symposium on Foundations of Computer Science (sfcs 1983), 1983
We investigate extensions of tenlporal logic by finite automata on infinite words. There are thre... more We investigate extensions of tenlporal logic by finite automata on infinite words. There are three different types of acceptance conditions (finite, looping and repeating) that one can give for these finite automata. This gives rise to three different logics. It turns out, ho\vever. that these logics have the same expressive po\ver but differ in the complexity of their decision problem. V/e also investigate the addition of alternation and sho\v that it does not increase the complexity of the decision problem.
International Journal of Foundations of Computer Science, 2009
This paper considers the problem of computing the real convex hull of a finite set of n-dimension... more This paper considers the problem of computing the real convex hull of a finite set of n-dimensional integer vectors. The starting point is a finite-automaton representation of the initial set of vectors. The proposed method consists in computing a sequence of automata representing approximations of the convex hull and using extrapolation techniques to compute the limit of this sequence. The convex hull can then be directly computed from this limit in the form of an automaton-based representation of the corresponding set of real vectors. The technique is quite general and has been implemented.
In computer system design, we distinguish between closed and open systems. A closed system is a s... more In computer system design, we distinguish between closed and open systems. A closed system is a system whose behavior is completely determined by the state of the system. An open system is a system that interacts with its environment and whose behavior depends on this interaction. The ability of temporal logics to describe an ongoing interaction of a reactive program with its environment makes them particularly appropriate for the specication of open systems. Nevertheless, model-checking algorithms used for the veri cation of closed systems are not appropriate for the veri cation of open systems. Correct model checking of open systems should check the system with respect to arbitrary environments and should take into account uncertainty regarding the environment. This is not the case with current model-checking algorithms and tools. In this paper we introduce and examine the problem of model checking of open systems (module checking, for short). We show that while module checking and model checking coincide for the linear-time paradigm, module checking is much harder than model checking for the branching-time paradigm. We prove that the problem of module checking is EXPTIMEcomplete for speci cations in CTL and is 2EXPTIME-complete for speci cations in CTL ?. This bad news is also carried over when we consider the program-complexity of module checking. As good news, we show that for the commonly-used fragment of CTL (universal, possibly, and always possibly properties), current model-checking tools do work correctly, or can be easily adjusted to work correctly, with respect to both closed and open systems.
This paper addresses the problem of designing memory-efficient algorithms for the verification of... more This paper addresses the problem of designing memory-efficient algorithms for the verification of temporal properties of finite-state programs. Both the programs and their desired temporal properties are modeled as automata on infinite words (Büchi automata). Verification is then reduced to checking the emptiness of the automaton resulting from the product of the program and the property. This problem is usually solved by computing the strongly connected components of the graph representing the product automaton. Here, we present algorithms which solve the emptiness problem without explicitly constructing the strongly connected components of the product graph. By allowing the algorithms to err with some probability, we can implement them with a randomly accessed memory of size O(n) bits, where n is the number of states of the graph, instead of O(n log n) bits that the presently known algorithms require.
This paper presents an algorithm for detecting deadlocks in concurrent finite-state systems witho... more This paper presents an algorithm for detecting deadlocks in concurrent finite-state systems without incurring most of the state explosion due to the modeling of concurrency by interleaving. For systems that have a high level of concurrency our algorithm can be much more efficient than the classical exploration of the whole state space. Finally, we show that our algorithm can also be used for verifying arbitrary safety properties.
Uploads
Papers by Pierre Wolper