Model Checking under Fairness in ProB and Its Application to Fair Exchange Protocols

Abstract

Abstract. Motivated by Murray's work on the limits of refinement testing for CSP, we propose the use of ProB to check liveness properties under assumptions of strong and weak event fairness, whose refinement-closures cannot generally be expressed as refinement checks for FDR. Such properties are necessary for the analysis of fair exchange protocols in CSP, which assume at least some messages are sent over a resilient channel. As the properties we check are refinement-closed, we retain CSP's theory of refinement, enabling subsequent step-wise refinement of the CSP model. Moreover, we improve upon existing CSP models of fair exchange protocols by proposing a revised intruder model inspired by the one of Cederquist and Dashti. Our intruder model is stronger as we use a weaker fairness constraint.

Foundations for using linear temporal logic in Event-B refinement

“…Moreover, the class of LTL operators that is supported by the theory also extends the LTL presented in [Gro06] and are those supported by ProB. Notably, our inclusion of the enabled operator, and its translation in Definition 7.1, (reflecting Lowe's available operator [Low08]) allows for the expression of temporal properties under various notions of fairness [Mur13,WdRF12]. The expression of fairness properties are typically required in proving pertinent liveness properties.…”

“…Our ongoing work is combining these results with those in this paper in order to provide a cohesive process algebra underpinning for Event-B and the preservation of LTL properties. It should not be surprising that the underpinning will be in terms of the refusal traces semantic model of CSP; Definitions 6.2 and 7.1 were based on [WdRF12,Low08], which addressed the preservation of LTL properties through refusal traces refinement. (In [Low08] temporal operators were defined in terms of the set of finite and infinite refusal traces they allow.…”

“…This definition allows us to take into account the new events that are introduced during refinement steps as required in clauses (6) and (14). It is inspired by [WdRF12] and we will reflect on this in Sect. 8.…”

“…This additional clause was inspired by the definition of availability in [WdRF12]. This translation clause means that the occurrence of one of the new events introduced during the refinement ( n∈N [n]) is permitted until either:…”

Managing LTL Properties in Event-B Refinement

“…Our notion of weak fairness will be akin to that described in Barradas and Bert in [4]. It will draw on work by Williams et al [16]. We could also consider the impact on temporal property preservation in refinement chains which do not achieve convergence of all its new events by the end.…”