## Property preserving abstractions for the verification of concurrent systems (1995)

Venue: | FORMAL METHODS IN SYSTEM DESIGN, VOL 6, ISS |

Citations: | 138 - 6 self |

### BibTeX

@INPROCEEDINGS{Loiseaux95propertypreserving,

author = {Claire Loiseaux and Susanne Graf and Joseph Sifakis and Ahmed Bouajjani and Saddek Bensalem},

title = {Property preserving abstractions for the verification of concurrent systems},

booktitle = {FORMAL METHODS IN SYSTEM DESIGN, VOL 6, ISS},

year = {1995},

publisher = {}

}

### Years of Citing Articles

### OpenURL

### Abstract

We study property preserving transformations for reactive systems. The main idea is the use of simulations parameterized by Galois connections ( �), relating the lattices of properties of two systems. We propose and study a notion of preservation of properties expressed by formulas of a logic, by a function mapping sets of states of a system S into sets of states of a system S'. We give results on the preservation of properties expressed in sublanguages of the branching time-calculus when two systems S and S' are related via h � i-simulations. They can be used to verify a property for a system by verifying the same property on a simpler system which is an abstraction of it. We show also under which conditions abstraction of concurrent systems can be computed from the abstraction of their components. This allows a compositional application of the proposed verification method. This is a revised version of the papers [2] and [16] � the results are fully developed in [27].

### Citations

3410 | A theory of communicating sequential processes
- BROOKES, HOARE, et al.
- 1984
(Show Context)
Citation Context ...med by one component while the other remains idle. The latter corresponds to moves of either some R 1i for i 62 A 1 or of some R 2j for j 62 A 2 . This operator allows to express the operators of Csp =-=[19]-=- or Lotos [20] by simulating message communication by communication through common variables. ffl Synchronous composition is a special case of mixed composition, where only the execution of synchronou... |

1332 |
A Calculus of Communicating Systems
- Milner
- 1982
(Show Context)
Citation Context ...perty preserving preorders and equivalences has also been widely studied. In this framework, the notions of abstractions are generally defined in terms of variants of simulation [31] and bisimulation =-=[32]-=-; the problem of the construction of abstract programs has only been addressed for notions of abstractions defined by equivalences. In the linear semantics framework, the intuitive notion of abstracti... |

1213 |
The temporal logic of programs
- Pnueli
- 1977
(Show Context)
Citation Context ...ote L ps. This logic subsumes in expressiveness the commonly used specification logics, such as the branching-time temporal logics CTL [9] and CTL [14] and also the linear-time temporal logics as PTL =-=[36]-=- and ETL [42]. We define fragments of the -calculus called Ls, 2L , 2L ps, 3Ls, and 3L ps(where p stands for logics containing past time operators). We show for two systems S 1 and S 2 that, if S 1 v ... |

806 | The temporal logic of actions
- Lamport
- 1994
(Show Context)
Citation Context ...s the transition relation relating any (n; true) 2 N \Theta Bool with (n + 1; b 0 ) where b 0 may take any boolean value as y 0 is not constraint in the expression R. This approach is used, e. g., in =-=[27]-=-, [37]. In the same way a relation ae from Dom(X) to Dom(XA ) is represented by a binary predicate of the form ae(X; XA ). In this setting, operations on sets (respectively relations) are expressed by... |

635 | Systematic design of program analysis frameworks
- Cousot, Cousot
- 1979
(Show Context)
Citation Context ...n order to be verified by available tools, and that still contains enough relevant details for the satisfaction of the considered properties. The framework of abstract interpretation (see for example =-=[7]-=-, [8]) addresses exactly this problem. Programs are represented by functions F on some lattice of properties. Given some abstract lattice of properties and a pair of functions (ff; fl), forming a Galo... |

624 | Model checking and abstraction
- Clarke, Grumberg, et al.
- 1994
(Show Context)
Citation Context ...ification over computation sequences (called 2Ls) are preserved by e fl from the abstract to the concrete system (where e fl is the dual of fl). These preservation results generalize results given in =-=[10]-=- where this problem is studied in the particular case where the property preserving function ff defines a structure homomorphism from the concrete to abstract system. Our preservation results together... |

472 | An introduction to Input/Output automata
- Lynch, Tuttle
- 1989
(Show Context)
Citation Context ...defined by equivalences. In the linear semantics framework, the intuitive notion of abstraction is inclusion (respectively equality) of observable computation sequences (see for example in [25], [1], =-=[30]-=-). However, this notion of abstraction does not directly induce a way of computing an abstract program for a given concrete program and observability criterion. Here, we take up again the approach fol... |

438 | The existence of refinement mappings
- Abadi, Lamport
- 1991
(Show Context)
Citation Context ...ions defined by equivalences. In the linear semantics framework, the intuitive notion of abstraction is inclusion (respectively equality) of observable computation sequences (see for example in [25], =-=[1]-=-, [30]). However, this notion of abstraction does not directly induce a way of computing an abstract program for a given concrete program and observability criterion. Here, we take up again the approa... |

335 |
On a decision method in restricted second order arithmetic
- Büchi
- 1962
(Show Context)
Citation Context ...rresponds to the fragment of 2Lswithout the least fixpoint operator . 17 Furthermore, it can be shown that any !-regular linear-time property, i. e., expressible by a nondeterministic Buchi automaton =-=[6], can be expres-=-sed in 2Ls[4]. For example, the safety property [26], [29], [34] "always P " can be expressed by the formula X:(Ps2X). Moreover, the guarantee property (according to [34]) "eventually P... |

323 |
Graph Based Algorithms for Boolean Function Manipulation
- Bryant
- 1986
(Show Context)
Citation Context ...classical symbolic model checking for CTL (see e. g. in [38]), we obtain jf A j S ae = true. By Theorem 2, we have that mutual exclusion holds on the concrete program. The recent developments of Bdds =-=[5]-=- and tools manipulating them, allows to do this evaluation efficiently if the abstract domain is finite. 7. Compositionality of simulation with respect to parallel composition In the previous sections... |

313 | Calculi for synchrony and asynchrony - Milner - 1983 |

307 | Proving the correctness of multiprocess programs
- Lamport
- 1977
(Show Context)
Citation Context ...r . 17 Furthermore, it can be shown that any !-regular linear-time property, i. e., expressible by a nondeterministic Buchi automaton [6], can be expressed in 2Ls[4]. For example, the safety property =-=[26], [29], [34] "a-=-lways P " can be expressed by the formula X:(Ps2X). Moreover, the guarantee property (according to [34]) "eventually P in any infinite computation sequence" can be expressed by the form... |

271 |
Automatic verification of finite-- state concurrent systems using temporal logic specifications
- Clarke, Emerson, et al.
- 1986
(Show Context)
Citation Context ...tract interpretation has been applied to programs represented by transition systems, where the lattice of properties is the powerset of states. There, results showing preservation of fragments of CTL =-=[9]-=- from the abstract to the concrete system have been given. In the framework of process algebras, the problem of property preserving preorders and equivalences has also been widely studied. In this fra... |

270 | Model Checking and Modular Verification
- Grumberg, Long
- 1994
(Show Context)
Citation Context ...is the same as , and this is the program composition operator used in Tla [27]. It can also be used to describe the parallel composition operators of Sccs [33], of S/R models [23] and the one used in =-=[15]-=-. ffl Asynchronous composition is the special case of the mixed composition where A = ;. That means that all moves are moves of either some R 1i where i 2 I 1 or of some R 2j where j 2 I 2 . This oper... |

260 |
Results on the propositional -calculus
- Kozen
- 1983
(Show Context)
Citation Context ...ameterized by the relation ae corresponding to the Galois connection (ff; fl). Then, we give preservation results for fragments of a future and past version of the branching time -calculus defined in =-=[24]-=- for the following notion of property preservation : an arbitrary function ff from the powerset of the states of a transition system S 1 to the powerset of the states of a transition system S 2 preser... |

247 | Abstract interpretation of reactive systems
- Dams, Gerth, et al.
- 1997
(Show Context)
Citation Context ...duced by ae \Gamma1 ae. There exist examples of interesting abstraction relations ae such that ae is not function. If ae = aeae \Gamma1 ae does not hold, then S ae is not necessarily faithful, and in =-=[12]-=- is given a way to compute faithful abstractions. S ae is induced by a slightly stronger notion of simulation than v ae (respectively v hff;fli ) which coincides with the notion of forward and backwar... |

247 |
Sometimes” and “not never” revisited: On branching versus linear time
- Emerson, Halpern
- 1983
(Show Context)
Citation Context ... [24] augmented by past time modalities, which we denote L ps. This logic subsumes in expressiveness the commonly used specification logics, such as the branching-time temporal logics CTL [9] and CTL =-=[14]-=- and also the linear-time temporal logics as PTL [36] and ETL [42]. We define fragments of the -calculus called Ls, 2L , 2L ps, 3Ls, and 3L ps(where p stands for logics containing past time operators)... |

199 |
Temporal logic can be more expressive
- Wolper
- 1983
(Show Context)
Citation Context ...s logic subsumes in expressiveness the commonly used specification logics, such as the branching-time temporal logics CTL [9] and CTL [14] and also the linear-time temporal logics as PTL [36] and ETL =-=[42]-=-. We define fragments of the -calculus called Ls, 2L , 2L ps, 3Ls, and 3L ps(where p stands for logics containing past time operators). We show for two systems S 1 and S 2 that, if S 1 v hff;fli S 2 ,... |

194 |
An algebraic definition of simulation between programs
- Milner
- 1971
(Show Context)
Citation Context ...as, the problem of property preserving preorders and equivalences has also been widely studied. In this framework, the notions of abstractions are generally defined in terms of variants of simulation =-=[31]-=- and bisimulation [32]; the problem of the construction of abstract programs has only been addressed for notions of abstractions defined by equivalences. In the linear semantics framework, the intuiti... |

162 | Comparing the Galois connection and widening/narrowing approaches to abstract interpretation
- Cousot, Cousot
- 1992
(Show Context)
Citation Context ...er to be verified by available tools, and that still contains enough relevant details for the satisfaction of the considered properties. The framework of abstract interpretation (see for example [7], =-=[8]-=-) addresses exactly this problem. Programs are represented by functions F on some lattice of properties. Given some abstract lattice of properties and a pair of functions (ff; fl), forming a Galois co... |

147 |
Parallel Program Design
- Chandy, Misra
- 1988
(Show Context)
Citation Context ...case of the mixed composition where A = ;. That means that all moves are moves of either some R 1i where i 2 I 1 or of some R 2j where j 2 I 2 . This operator is exactly the "union operator"=-= of Unity [11]-=-. Lemma 4 Let be S i = fR ij (X i ; X 0 i ) j j 2 I i g; i 2 f1; 2g and A`I 1 \Theta I 2 a synchronization set as before. Then, ffl S 1 jjj S 2 = S 1 j[;]j S 2 ffl If A such that A 1 = A 2 = ;, then S... |

138 |
The glory of the past
- Lichtenstein, Pnueli, et al.
- 1985
(Show Context)
Citation Context ... Furthermore, it can be shown that any !-regular linear-time property, i. e., expressible by a nondeterministic Buchi automaton [6], can be expressed in 2Ls[4]. For example, the safety property [26], =-=[29], [34] "always -=-P " can be expressed by the formula X:(Ps2X). Moreover, the guarantee property (according to [34]) "eventually P in any infinite computation sequence" can be expressed by the formulasX:... |

135 |
Applications of temporal logic to specification and verification of reactive systems: A survey of current trends
- Pnueli
(Show Context)
Citation Context ...transition relation relating any (n; true) 2 N \Theta Bool with (n + 1; b 0 ) where b 0 may take any boolean value as y 0 is not constraint in the expression R. This approach is used, e. g., in [27], =-=[37]-=-. In the same way a relation ae from Dom(X) to Dom(XA ) is represented by a binary predicate of the form ae(X; XA ). In this setting, operations on sets (respectively relations) are expressed by logic... |

64 |
Analysis of Discrete Event Coordination
- Kurshan
- 1990
(Show Context)
Citation Context ...stractions defined by equivalences. In the linear semantics framework, the intuitive notion of abstraction is inclusion (respectively equality) of observable computation sequences (see for example in =-=[25]-=-, [1], [30]). However, this notion of abstraction does not directly induce a way of computing an abstract program for a given concrete program and observability criterion. Here, we take up again the a... |

51 |
A hierarchy of temporal properties
- Manna, Pnueli
- 1987
(Show Context)
Citation Context ...ermore, it can be shown that any !-regular linear-time property, i. e., expressible by a nondeterministic Buchi automaton [6], can be expressed in 2Ls[4]. For example, the safety property [26], [29], =-=[34] "always P &quo-=-t; can be expressed by the formula X:(Ps2X). Moreover, the guarantee property (according to [34]) "eventually P in any infinite computation sequence" can be expressed by the formulasX:(Ps2X)... |

49 |
Properly preserving simulations
- Bensalem, Bouajjani, et al.
- 1992
(Show Context)
Citation Context ...on of concurrent systems can be computed from the abstraction of their components. This allows a compositional application of the proposed verification method. This is a revised version of the papers =-=[2]-=- and [16]; the results are fully developed in [28]. Keywords: abstract interpretation, simulation, property preservation, model-checking. 1. Introduction The growing complexity of distributed and reac... |

45 |
Galois connexions
- Ore
- 1944
(Show Context)
Citation Context ...es exactly this problem. Programs are represented by functions F on some lattice of properties. Given some abstract lattice of properties and a pair of functions (ff; fl), forming a Galois connection =-=[35]-=- from the concrete to the abstract lattice, a functionsG on the abstract lattice is an abstraction of F if ff ffi F ffi fl ` G holds. This guarantees that greatest and least fixpoints of G represent u... |

38 | The existence of re nement mappings - Abadi, Lamport - 1991 |

34 | Atool for symbolic program verification and abstraction
- Graf, Loiseaux
- 1993
(Show Context)
Citation Context ...traction, verification of the formula and checking preservation of the predicates. We have implemented a symbolic verification tool supporting this 28 method for finite state programs encoded as Bdds =-=[17]-=-, [28]: Programs are parallel compositions of components which are predicates (just as the program used in the example in Section 4.2) on boolean variables. An abstract program may be obtained by comp... |

30 |
Verification of a distributed cache memory by using abstractions
- Graf
- 1994
(Show Context)
Citation Context ... we have verified a protocol described in [13]. For this protocol, the use of the compositionality results of Section 7 was essential in order to be able to compute an appropriate abstract system. In =-=[18]-=-, we applied the same verification method to an infinite state system, a distributed cache memory [13] which is known to be difficult to verify. For this example, the abstract program could not be obt... |

17 |
On decomposing and refining specifications of distributed systems
- Jonsson
- 1990
(Show Context)
Citation Context ...l abstractions. S ae is induced by a slightly stronger notion of simulation than v ae (respectively v hff;fli ) which coincides with the notion of forward and backward simulation used, e. g. in [21], =-=[22]-=- if ae is total. Definition 7 ( ae andshff;fli ) Let S = (Q; R) and SA = (QA ; RA ) be transition systems, and ae ` Q \Theta QA total on Q and (ff; fl) a total connection from 2 Q to 2 QA . Then, ffl ... |

17 |
Property preserving homomorphisms of transition systems
- Sifakis
- 1983
(Show Context)
Citation Context ...sent upper approximations of corresponding fixpoints of F . Until recently, this approach has only been applied for the verification of invariance properties of sequential programs. However, in [40], =-=[41]-=-, the idea of abstract interpretation has been applied to programs represented by transition systems, where the lattice of properties is the powerset of states. There, results showing preservation of ... |

10 | Automatic veri cation of - nite state concurrent system using temporal logic speci cations: a practical approach - Clarke, Emerson, et al. - 1983 |

9 |
Specification and validation of a simple overtaking protocol using LOTOS
- Ernberg, Fredlund, et al.
- 1990
(Show Context)
Citation Context ...ct and concrete variables. Internally all predicates are represented by Bdds. A symbolic model checker allows the verification of properties. Using this tool, we have verified a protocol described in =-=[13]-=-. For this protocol, the use of the compositionality results of Section 7 was essential in order to be able to compute an appropriate abstract system. In [18], we applied the same verification method ... |

9 |
S/R: A Language for Specifying Protocols and other Coordinating Processes
- Katzelson, Kurshan
- 1986
(Show Context)
Citation Context ...heta I 2 , this operator is the same as , and this is the program composition operator used in Tla [27]. It can also be used to describe the parallel composition operators of Sccs [33], of S/R models =-=[23]-=- and the one used in [15]. ffl Asynchronous composition is the special case of the mixed composition where A = ;. That means that all moves are moves of either some R 1i where i 2 I 1 or of some R 2j ... |

9 | Applications of temporal logic to the speci - cation and veri cation of reactive systems: A survey of current trends - Pnueli - 1986 |

7 |
Program Verification using Compositional Abstraction
- Graf, Loiseaux
(Show Context)
Citation Context ...ncurrent systems can be computed from the abstraction of their components. This allows a compositional application of the proposed verification method. This is a revised version of the papers [2] and =-=[16]-=-; the results are fully developed in [28]. Keywords: abstract interpretation, simulation, property preservation, model-checking. 1. Introduction The growing complexity of distributed and reactive syst... |

7 | An algebraic de nition of simulation between programs - Milner - 1971 |

5 |
Process simulation and refinement
- Jifeng
- 1989
(Show Context)
Citation Context ...aithful abstractions. S ae is induced by a slightly stronger notion of simulation than v ae (respectively v hff;fli ) which coincides with the notion of forward and backward simulation used, e. g. in =-=[21]-=-, [22] if ae is total. Definition 7 ( ae andshff;fli ) Let S = (Q; R) and SA = (QA ; RA ) be transition systems, and ae ` Q \Theta QA total on Q and (ff; fl) a total connection from 2 Q to 2 QA . Then... |

4 | Program veri cation using compositional abstraction - Graf, Loiseaux - 1993 |

3 |
V'erification symbolique de programmes r'eactifs `a l'aide d'abstractions
- Loiseaux
- 1994
(Show Context)
Citation Context ... abstraction of their components. This allows a compositional application of the proposed verification method. This is a revised version of the papers [2] and [16]; the results are fully developed in =-=[28]-=-. Keywords: abstract interpretation, simulation, property preservation, model-checking. 1. Introduction The growing complexity of distributed and reactive systems requires rigorous development methodo... |

3 |
Le systéme CESAR : description, spécification et analyse des applications réparties. Université Scientifique et Médicale de
- Queille
- 1982
(Show Context)
Citation Context ...rify f on S ae , we have to translate the atomic predicates by post[ae], resulting in the formula f A : (b 1sb 2 ) ) X:((b 1sb 2 )s2X) By using classical symbolic model checking for CTL (see e. g. in =-=[38]-=-), we obtain jf A j S ae = true. By Theorem 2, we have that mutual exclusion holds on the concrete program. The recent developments of Bdds [5] and tools manipulating them, allows to do this evaluatio... |

3 | A tool for symbolic program veri cation and abstraction - Graf, Loiseaux - 1993 |

3 | Veri cation of a distributed cache memory by using abstractions - Graf - 1994 |

2 |
Safety for branching semantics
- Bouajjani, Fernandez, et al.
- 1991
(Show Context)
Citation Context ...ously, the same translation can be done from L (p)sto L (p)+ fors2 f2; 3g. In 2L we can express branching-time properties as for instance the safety properties with respect to the simulation preorder =-=[3]-=-. The class of these properties corresponds to the fragment of 2Lswithout the least fixpoint operator . 17 Furthermore, it can be shown that any !-regular linear-time property, i. e., expressible by a... |

2 |
ISO/OSI 8807 - LOTOS: a formal description technique based on the temporal ordering of observational behaviour
- IS
- 1989
(Show Context)
Citation Context ...ponent while the other remains idle. The latter corresponds to moves of either some R 1i for i 62 A 1 or of some R 2j for j 62 A 2 . This operator allows to express the operators of Csp [19] or Lotos =-=[20]-=- by simulating message communication by communication through common variables. ffl Synchronous composition is a special case of mixed composition, where only the execution of synchronous transitions ... |

2 |
Data types as lattices: retractions, closures and projections
- Sanchis
- 1977
(Show Context)
Citation Context ...post [oe] ffi g post [ae]. 2.2. Galois connections We give hereafter the definition of Galois connections and some useful well-known results about them. More information can, e. g., be found in [35], =-=[39]-=-. Definition 3 (Connections) Let Q 1 and Q 2 be two sets of states. A connection from 2 Q1 to 2 Q2 is a pair of monotonic functions (ff; fl), where ff : 2 Q1 ! 2 Q2 and fl : 2 Q2 ! 2 Q1 , such that Id... |

1 |
From Linear-Time Propositional Temporal Logics to a Branching-Time -calculus
- Bouajjani
- 1989
(Show Context)
Citation Context ... 2Lswithout the least fixpoint operator . 17 Furthermore, it can be shown that any !-regular linear-time property, i. e., expressible by a nondeterministic Buchi automaton [6], can be expressed in 2Ls=-=[4]. For example, -=-the safety property [26], [29], [34] "always P " can be expressed by the formula X:(Ps2X). Moreover, the guarantee property (according to [34]) "eventually P in any infinite computation... |

1 |
A calculus for Synchronyand Asynchrony
- Milner
- 1983
(Show Context)
Citation Context ...ase where A = I 1 \Theta I 2 , this operator is the same as , and this is the program composition operator used in Tla [27]. It can also be used to describe the parallel composition operators of Sccs =-=[33]-=-, of S/R models [23] and the one used in [15]. ffl Asynchronous composition is the special case of the mixed composition where A = ;. That means that all moves are moves of either some R 1i where i 2 ... |

1 |
Property preserving homomorphisms and a notion of simulation of transition systems
- Sifakis
- 1982
(Show Context)
Citation Context ... represent upper approximations of corresponding fixpoints of F . Until recently, this approach has only been applied for the verification of invariance properties of sequential programs. However, in =-=[40]-=-, [41], the idea of abstract interpretation has been applied to programs represented by transition systems, where the lattice of properties is the powerset of states. There, results showing preservati... |