Safety and liveness in branching time

Relating word and tree automata

In the automata-theoretic approach to verification, we translate specifications to automata. Complexity considerations motivate the distinction between different types of automata. Already in the 60's, it was known that deterministic Buchi word automata are less expressive than nondeterministic Buchi word automata. The proof is easy and can be stated in a few lines. In the late 60's, Rabin proved that Buchi tree automata are less expressive than Rabin tree automata. This proof is much harder. In this work we relate the expressiveness gap between deterministic and nondeterministic Buchi word automata and the expressiveness gap between Buchi and Rabin tree automata. We consider tree automata that recognize derived languages. For a word language L, the derived language of L, denoted L/spl Delta/, is the set of all trees all of whose paths are in L. Since often we want to specify that all the computations of the program satisfy some property, the interest in derived languages is clear. Our main result shows that L is recognizable by a nondeterministic Buchi word automaton but not by a deterministic Buchi word automaton iff L/spl Delta/ is recognizable by a Rabin tree automaton and not by a Buchi tree automaton. Our result provides a simple explanation to the expressiveness gap between Buchi and Rabin tree automata. Since the gap between deterministic and nondeterministic Buchi word automata is well understood, our result also provides a characterization of derived languages that can be recognized by Buchi tree automata. Finally, it also provides an exponential determinization of Buchi tree automata that recognize derived languages.

Quantified Computation Tree Logic

This paper presents a formal characterisation of safety and liveness properties for fully probabilistic systems. As for the classical setting, it is established that any (probabilistic tree) property is equivalent to a conjunction of a safety and liveness property. A simple algorithm is provided to obtain such a property decomposition for flat probabilistic CTL (PCTL). A safe fragment of PCTL is identified that provides a sound and complete characterisation of safety properties. For liveness properties, we provide two PCTL fragments, a sound and a complete one, and show that a sound and complete logical characterisation of liveness properties hinges on the (open) satisfiability problem for PCTL. We show that safety properties only have finite counterexamples, whereas liveness properties have none. We compare our characterisation for qualitative properties with the one for branching time properties by Manolios and Trefler, and present sound and complete PCTL fragments for characterising the notions of strong safety and absolute liveness coined by Sistla.

Partial order methods have been introduced to avoid the state explosion problem in verification resulting from the representation of multiple interleavings of concurrent transitions. The basic idea is to build a reduced state space on which certain properties hold if and only if they hold for the full state space. Most often, the considered properties are linear-time properties. In this paper we suggest novel branching time reduction techniques which allow checking bisimulation equivalence on reduced state spaces. Our reduction takes place on bisimulation game graphs, thus jointly treating the systems under consideration. We show that reduction preserves winning strategies of the two players in the bisimulation game.

Verification of Concurrent Assembly Programs with a Petri Net Based Safety Policy

Over the last few years there has been an increasing research effort directed towards the automatic verification of infinite-state systems. There are now verification techniques for many classes of infinite-state systems, including timed and hybrid automata, petri nets, pushdown systems, systems with FIFO channels, systems with a simple treatment of data, etc. In this tutorial, we will cover general verification techniques that have been used for infinite-state and parameterized systems, and try to show their power and limitations. Such techniques are e.g., symbolic model-checking techniques, abstraction, induction over the networks structure, widening, and automata-based techniques. We will focus on linear-time safety and liveness properties.

SLA-Driven modeling and verifying cloud systems: A Bigraphical reactive systems-based approach

Scenarios and use cases are popular means of describing the intended system behaviour. They support a variety of features and, notably, allow for two different interpretations: existential and universal. These modalities allow a progressive shift from examples to general rules about the expected system behaviour. The combination of modalities in a scenario-based specification poses technical challenges when automated reasoning is to be provided. In particular, the use of conditional existential scenarios, of which use cases with preconditions are a common example, require reasoning in branching time. Yet, formally grounded approaches to requirements engineering and industrial verification approaches shy away from branching-time logics due to their relatively unintuitive semantics.In this paper, we define an extension of an (industry standard) linear-time logic with sufficient branching expressiveness to allow capturing conditional existential statements. The resulting logic, called CSSL (Conditional Scenario Specification Language), has an efficient model-checking procedure. It supports reasoning about heterogeneous requirements specifications that include universal and existential statements in the form of use cases and conditional existential scenarios, and other sequence chart variants, in addition to general (linear) liveness and safety properties. We report on two industrial case studies in which the logic was used to specify and verify scenarios and properties.

Modalities for model checking: branching time logic strikes back

Role Based Access Control (RBAC) is arguably the most common access control mechanism today due to its applicability at various levels of authorization in a system. Time varying nature of access control in RBAC administered systems is often implemented through Temporal-RBAC - an extension of RBAC in the temporal domain. In this paper, we propose an initial approach towards verification of security properties of a Temporal-RBAC system. Each role is mapped to a timed automaton. A controller automaton is used to activate and deactivate various roles. Security properties are specified using Computation Tree Logic (CTL) and are verified with the help of a model checking tool named Uppaal. We have specifically considered reachability, safety and liveness properties to show the usefulness of our approach.

This article presents a case study on verifying formally a multiprocessor system with shared memory using the model-checking technique. The system consists of a set of processors where each processor has its own cache, the shared main memory and the bus. The RTL (Register Transfer Level) design of the system is described in a Verilog-HDL code, and the behaviour is specified by a set of CTL (Computation Tree Logic) properties. We establish the effect of data width upon the reachability analysis. We successfully verify a set of critical safety and liveness properties for the system design. The experiments demonstrate the effectiveness of our methods. The verification results manifest the relationship between the state space, BDD (Binary Decision Diagram) size, and the verification time when the data width and the number of processors increase.

This paper presents a formal methodology of modeling and verification about WTB-TCN device based on extended Petri net model. By translating the model into timed automata, properties of WTB-TCN device can be completely verified using symbolic model checking technique. The methodology proposed addresses the model checking of critical properties of WTB-TCN device including safety, liveness and fairness properties which are expressed in computation tree logics. As a confirmation of its validity, the methodology described in this paper has been successfully applied to modeling and formal verification of WTB-TCN device.

Let P be a property of graphs. An epsiv/-test for P is a randomized algorithm which, given the ability to make queries whether a desired pair of vertices of an input graph G with n vertices are adjacent or not, distinguishes, with high probability, between the case of G satisfying P and the case that it has to be modified by adding and removing more than epsiv/n/sup 2/ edges to make it satisfy P. The property P is called testable, if for every epsiv/ there exists an epsiv/-test for P whose total number of queries is independent of the size of the input graph. O. Goldreich et al. (1996) showed that certain graph properties admit an epsiv/-test. In this paper we make a first step towards a logical characterization of all testable graph properties, and show that properties describable by a very general type of coloring problem are testable. We use this theorem to prove that first order graph properties not containing a quantifier alternation of type /spl forall//spl exist/ are always testable, while we show that some properties containing this alternation are not. Our results are proven using a combinatorial lemma, a special case of which, that may be of independent interest, is the following. A graph H is called epsiv/-unavoidable in G if all graphs that differ from G in no more than epsiv/|G|/sup 2/ places contain an induced copy of H. A graph H is called delta/-abundant in G if G contains at least delta/|G|/sup |H|/ induced copies of H. If H is epsiv/-unavoidable in G then it is also delta/(/spl epsiv/, |H|)-abundant.

We present a sound, complete and relatively straightforward tableau method for deciding valid formulas in the propositional version of the bundled (or suffix and fusion closed) computation tree logic BCTL*. This proves that BCTL* is decidable. It is also moderately useful to have a tableau available for a reasonably expressive branching time temporal logic. However, the main interest in this should be that it leads us closer to being able to devise a tableau-based technique for theorem-proving in the important full computational tree logic CTL*.