Partial Model Checking using Networks of Labelled Transition Systems and Boole an Equation Systems

Abstract

Abstract. Partial model checking was proposed by Andersen in 1995 to verify a temporal logic formula compositionally on a composition of processes. It consists in incrementally incorporating into the formula the behavioural information taken from one process -an operation called quotienting -to obtain a new formula that can be verified on a smaller composition from which the incorporated process has been removed. Simplifications of the formula must be applied at each step, so as to maintain the formula at a tractable size. In this paper, we revisit partial model checking. First, we extend quotienting to the network of labelled transition systems model, which subsumes most parallel composition operators, including m-among-n synchronisation and parallel composition using synchronisation interfaces, available in the E-Lotos standard. Second, we reformulate quotienting in terms of a simple synchronous product between a graph representation of the formula (called formula graph) and a process, thus enabling quotienting to be implemented efficiently and easily, by reusing existing tools dedicated to graph compositions. Third, we propose simplifications of the formula as a combination of bisimulations and reductions using Boolean equation systems applied directly to the formula graph, thus enabling formula simplifications also to be implemented efficiently. Finally, we describe an implementation in the Cadp (Construction and Analysis of Distributed Processes) toolbox and present some experimental results in which partial model checking uses hundreds of times less memory than on-the-fly model checking.

Debugging of Concurrent Systems Using Counterexample Analysis

“…The computation of the counterexample LTS is achieved by a script we wrote using SVL [10], a scripting language that allows one to interface with tools provided in the CADP toolbox. This script calls several tools: a specific option of Evaluator for building an LTS from a formula following the algorithm in [12]; EXP.OPEN for building LTS products; Reductor for minimizing LTSs; Scrutator [15] for removing spurious traces in LTSs. The second part of our tool implements the algorithms for state matching (2), state comparison (3) and counterexample abstraction (4), described from Section 3.2 to Section 3.4.…”

“…1. Full LTS and counterexample LTS described in [12]. M ϕ is a finite representation of t ϕ , using final transitions,…”

Equivalence Checking 40 Years After: A Review of Bisimulation Tools

“…Smart reduction and sharp bisimulations play a major role in modern approaches to compositional verification. Together with recent developments [292] around the idea of partial model checking [8], they enabled scientists from Grenoble and Pisa to solve nearly all the parallel problems of the RERS 7 verification challenge in 2019 8 and 2020 9 .…”

Debugging of Behavioural Models using Counterexample Analysis

“…Step a) Conversion of the ϕ formula describing the property into an LTS called M ϕ , using the technique that allows the encoding of a formula into a graph described in [9]. Given an action formula that represents a logical formula built from basic action predicates and boolean operators, this technique builds the LTS by replacing action formulas with finite sets of transitions that can potentially occur in the process composition.…”