Towards a Model-Checker for Counter Systems

Abstract

Abstract. This paper deals with model-checking of fragments and extensions of CTL* on infinite-state Presburger counter systems, where the states are vectors of integers and the transitions are determined by means of relations definable within Presburger arithmetic. We have identified a natural class of admissible counter systems (ACS) for which we show that the quantification over paths in CTL* can be simulated by quantification over tuples of natural numbers, eventually allowing translation of the whole Presburger-CTL* into Presburger arithmetic, thereby enabling effective model checking. We have provided evidence that our results are close to optimal with respect to the class of counter systems described above. Finally, we design a complete semi-algorithm to verify first-order LTL properties over trace-flattable counter systems, extending the previous underlying FAST semi-algorithm to verify reachability questions over flattable counter systems.

The Theory of WSTS: The Case of Complete WSTS

“…One can also decide whether the graph G f of a function f is monotonic because monotonicity of a Presburger-definable function can be expressed as a Presburger formula. Finally, one can also decide whether a Presburger formula represents an affine function f (x) = Ax + b with A ∈ N n×n and b ∈ Z n , using results by Demri et al [DFGvD06].…”

Towards Model-Checking Programs with Lists

“…We define a CTL * logic which is able to express quantitative properties of the memory managed by pointer systems. For this temporal logic, we show that the model-checking problem reduces to the one for counter systems developed in [13], provided an adequate translation from pointers to counters is given. This result is important for us, since it serves as a foundation for a two-steps analysis of pointer systems that consists in translating them into counter systems and then, with the help of FAST, to verify safety properties.…”

“…The next result shows that the theorem 1 can be extended to temporal properties, in fact : Theorem 2. [13] For a flat counter system CS with the finite monoid property, and a FOCTL * (P r) formula Φ, it is decidable whether CS |= Φ.…”

“…Counters could model parameters of list-scanning algorithms (for instance, a procedure that returns the nth element of a list), but also concurrency aspects like semaphores, thread identifier, etc. Quantitative shape analysis could be well suited for model-checking temporal properties relying on the algorithms already proposed for counter systems, such as in [13]. Previous attempts of model-checking temporal properties on pointer systems have been mostly based on either over-approximating, or non terminating algorithms for which completeness is usually poorly studied.…”

“…FAST implements a loops acceleration that succeeds in computing the reachability set of any flat counter system; the same acceleration can be exploited to model-check CTL * properties on these systems [13]. By flat, we mean that the control flow graph does not contain nested loops.…”