FDR3 — A Modern Refinement Checker for CSP

Abstract

Abstract. FDR3 is a complete rewrite of the CSP refinement checker FDR2, incorporating a significant number of enhancements. In this paper we describe the operation of FDR3 at a high level and then give a detailed description of several of its more important innovations. This includes the new multi-core refinement-checking algorithm that is able to achieve a near linear speed up as the number of cores increase. Further, we describe the new algorithm that FDR3 uses to construct its internal representation of CSP processes-this algorithm is more efficient than FDR2's, and is able to compile a large class of CSP processes to more efficient internal representations. We also present experimental results that compare FDR3 to related tools, which show it is unique (as far as we know) in being able to scale beyond the bounds of main memory.

Modelling the Haemodialysis Machine with Circus

“…Due to the current lack of tool support for direct checking of Circus specifications, we needed to translate our model, by hand, into CSP in order to be able to perform model checking using FDR3 [3]. In our translation, we had to adapt the Circus model for CSP M because Circus programs has explicit state-based features (such as assignment), which are not present in CSP M , which instead relies on process parameter-lists to handle state.…”

“…The current approach to model-checking Circus is to translate it into machinereadable CSP (CSP M ), and use FDR3 [3] to do the model checking. Unfortunately, there is no automated way to do this, so such translations have to be done by hand.…”

“…We then give an overview of the approach and present some of the modelling infrastructure in §3, before describing how some of the software requirements were modelled as processes in §4, where we also discuss how they were then assembled to give the full model. An issue with Circus is the availability of tool support, and so we discuss in §5 how we translated our model by hand into machine-readable CSP (CSPm), so that we could use the FDR3 refinement-checker [3]. We talk about issues and inconsistencies spotting during the modelling process in §6, and then, in §7, we conclude.…”

Modelling and Verifying a Priority Scheduler for an SCJ Runtime Environment

“…For the icecap case study, we carry out proof of properties of the Z data model using Z/Eves [25], and translate the Circus model to CSP to use the FDR3 model checker [14]. In the translation, we lose the expressiveness of Z, but gain the ability to use automatic analysis of the process network.…”

“…The Circus model is translated to CSP for automatic analysis using FDR3 [14]: a powerful refinement checker for CSP enabling automatic checking for deadlock and livelock freedom, as well as other properties of interest.…”