A theory of normed simulations

Abstract

In existing simulation proof techniques, a single step in a lower-level specification may be simulated by an extended execution fragment in a higher-level one. As a result, it is cumbersome to mechanize these techniques using general-purpose theorem provers. Moreover, it is undecidable whether a given relation is a simulation, even if tautology checking is decidable for the underlying specification logic. This article studies various types of normed simulations. In a normed simulation, each step in a lower-level specification can be simulated by at most one step in the higher-level one, for any related pair of states. In earlier work we demonstrated that normed simulations are quite useful as a vehicle for the formalization of refinement proofs via theorem provers. Here we show that normed simulations also have pleasant theoretical properties: (1) under some reasonable assumptions, it is decidable whether a given relation is a normed forward simulation, provided tautology checking is decidable for the underlying logic; (2) at the semantic level, normed forward and backward simulations together form a complete proof method for establishing behavior inclusion, provided that the higher-level specification has finite invisible nondeterminism.

On the refinement of liveness properties of distributed systems

“…We refer the reader to [17,20] for details. The conditions can be verified using theorem provers such as PVS [47].…”

“…The conditions can be verified using theorem provers such as PVS [47]. For lack of space, we omit an extended discussion of these issues, which can be found, for example, in [20]. That paper presents normed simulations, where the existence of a finite execution fragment at the abstract level that matches a concrete transition is replaced by the existence of either a single matching transition, or an internal transition that decreases a supplied norm (a function over a well-founded domain).…”

Universal extensions to simulate specifications

“…One may replace the integers in (SF1) by a well-founded partial order as in Ladkin et al [16,Fig. 21], Manolios [20], and Griffioen and Vaandrager [5]. This gives somewhat more flexibility, but it is also semantically equivalent.…”

“…Note that there are numerous related notions of simulations and bisimulations for transition systems, automata, process algebra terms, Kripke structures etc., cf. Milner [21], Park [24], Lynch and Vaandrager [18], de Nicola and Vaandrager [3], van Glabbeek and Weijland [26], Attie [2], Manolios [20], Griffioen and Vaandrager [5], Nejati et al [22], but in none of these papers arbitrary liveness properties are taken care of.…”

Compositional Abstraction in Real-Time Model Checking

“…The idea to use simulations (or refinements) as a compositional abstraction device is well-known, both in untimed and timed settings, and has already been studied theoretically and practically in many papers during the last three decades, see for instance [28,23,19,26,22,20,1,27,16,17,14,12,21]. Nevertheless, when we attempted to apply these existing approaches to fight state space explosions in a model of an industrial protocol [13], we ran into the problem that these approaches do not handle two fundamental modeling concepts that are frequently used in Uppaal.…”