Tight Cutoffs for Guarded Protocols with Fairness

Abstract

Guarded protocols were introduced in a seminal paper by Emerson and Kahlon (2000), and describe systems of processes whose transitions are enabled or disabled depending on the existence of other processes in certain local states. We study parameterized model checking and synthesis of guarded protocols, both aiming at formal correctness arguments for systems with any number of processes. Cutoff results reduce reasoning about systems with an arbitrary number of processes to systems of a determined, fixed size. Our work stems from the observation that existing cutoff results for guarded protocols i) are restricted to closed systems, and ii) are of limited use for liveness properties because reductions do not preserve fairness. We close these gaps and obtain new cutoff results for open systems with liveness properties under fairness assumptions. Furthermore, we obtain cutoffs for the detection of global and local deadlocks, which are of paramount importance in synthesis. Finally, we prove tightness or asymptotic tightness for the new cutoffs.Comment: Accepted for publication at VMCAI 2016. Extended version, revised after conference review

Structural Invariants for the Verification of Systems with Parameterized Architectures

“…correctness for at most c processes implies correctness for any number of processes [16,25,24,7,31]. Other methods identify systems with well-structured transition relations [29,1,27].…”

Parameterized model checking of rendezvous systems

“…Overall, since we also have that querying the transition relation of K (C, U ) is cheap, we conclude that one can guess any lasso in K (C, U ) in time polynomial in |C| × |U |. 10 Note that not all such products are legal paths in A, since A contains a transition from ( p, q) to ( p , q ) only if A ¬φ has a transition from p to p while reading the atomic propositions that are true in q. 11 To see this, note that K (C, U ) is the destuttering of an automaton with O(|T |) many states and input alphabet of size |C|, and apply Lemma 1.…”

“…A similar result has been shown in a slightly more complex scenario (viz. controlled clique topologies with 2-indexed LTL\X) [10]. Proof Consider the process template depicted in Fig.…”

“…Hence, checking that A is not empty can be done by guessing the lassos x, y and checking that their product is indeed a lasso in A. 10 11 the length of the longest simple path, and thus also of the longest lasso, of K (C, U ) is of length O(|C| 2 × |U |). Overall, since we also have that querying the transition relation of K (C, U ) is cheap, we conclude that one can guess any lasso in K (C, U ) in time polynomial in |C| × |U |.…”

“…In many of these cases it is even possible to reduce the problem of whether a parameterized system satisfies a temporal specification for any number of processes to the same problem for systems with at most c processes. In fact, it is usually of interest to find such a number c that works for every specification formula of a given temporal logic [2,10,16,26,28]. Such a number is known as a cutoff for the given parameterized system.…”