Structural Invariants for the Verification of Systems with Parameterized Architectures

Abstract

We consider parameterized concurrent systems consisting of a finite but unknown number of components, obtained by replicating a given set of finite state automata. Components communicate by executing atomic interactions whose participants update their states simultaneously. We introduce an interaction logic to specify both the type of interactions (e.g. rendez-vous, broadcast) and the topology of the system (e.g. pipeline, ring). The logic can be easily embedded in monadic second order logic of κ ≥ 1 successors (WSκS), and is therefore decidable.Proving safety properties of such a parameterized system, like deadlock freedom or mutual exclusion, requires to infer an inductive invariant that contains all reachable states of all system instances, and no unsafe state. We present a method to automatically synthesize inductive invariants directly from the formula describing the interactions, without costly fixed point iterations. We experimentally prove that this invariant is strong enough to verify safety properties of a large number of systems including textbook examples (dining philosophers, synchronization schemes), classical mutual exclusion algorithms, cache-coherence protocols and self-stabilization algorithms, for an arbitrary number of components. arXiv:2002.07672v1 [cs.DC] 18 Feb 2020correctness for at most c processes implies correctness for any number of processes [16,25,24,7,31]. Other methods identify systems with well-structured transition relations [29,1,27]. An exhaustive chart of decidability results for verification of parameterized systems is drawn in [12]. When decidability is not of concern, over-approximating and semi-algorithmic techniques such as regular model checking [33,2], SMT-based bounded model checking [4,19], abstraction [10,14] and automata learning [17] can be used to deal with more general classes of systems.The efficiency of a verification method crucially relies on its ability to synthesize an inductive safety invariant, i.e., an infinite set of configurations that contains the initial configurations, is closed under the transition relation, and excludes the error configurations. In general, automatically synthesizing invariants requires computationally expensive fixpoint iterations [20]. In the particular case of parameterized systems, invariants can be either global, relating the local states of all processes [21], or modular, relating the local states of a few processes whose identity is irrelevant [35,18]. Our Contributions. The novelty of the approach described in this paper is three-fold:1. The architecture of the system is not fixed a priori, but given as a parameter of the verification problem. In fact, we describe parameterized systems using the Behavior-Interaction-Priorities (BIP) framework [9], in which processes are instances of finite-state component types, whose interfaces are sets of ports, labeling transitions between local states, and interactions are sets of strongly synchronizing ports, described by formulae of an interaction logic. An interaction formula captur...

Specification and Safety Verification of Parametric Hierarchical Distributed Systems

“…Concerning trees, the tree-dfs example models a binary tree architecture traversed by a token in depth-first order, while tree-back-root and tree-linked-leaves(-generic) go beyond trees, modeling hierarchical systems with parent-children communication on top of which the nodes communicate with the root and the leaves are linked in a token-ring, respectively. These examples could not have been described using first order logic, as in [4]. The verification problems considered could be solved in less than 1 second, with the exception of the critical section violations for the tree-linked-leaves(-generic) examples, that require mutex, in addition to trap invariants.…”

Structural Invariants for the Verification of Systems with Parameterized Architectures

“…As demonstrated in Section 3 the pre-and postset of transitions, as well as general sets of places in a PN describing the execution semantics can be defined in WSκS. Hence, we present the definitions of the following formulae only in the full version of this article [16] and just give the intuitions here.…”

Architecture Modelling of Parametric Component-Based Systems

“…MIL was used for the description of parametric rendezvous and broadcast communication and applied for developing an automated method for detecting deadlocks. In the same line, in [11], an Interaction Logic with One Successor (IL1S) was developed for describing rendezvous and broadcast communications, and the architectures of parametric systems. IL1S was proved to be decidable and used for checking correctness of safety properties of parametric systems.…”

“…The interface of an LTS corresponds to its set of labels, called ports. Then, communications of components are defined by interactions, i.e., sets of ports, that can be represented by formulas of propositional interaction logic (PIL for short) [10,11,28]. Hence, firstly we need to recall PIL.…”