## Verification of Concurrent Programs: The Automata-Theoretic Framework (1987)

Venue: | Annals of Pure and Applied Logic |

Citations: | 47 - 3 self |

### BibTeX

@INPROCEEDINGS{Vardi87verificationof,

author = {Moshe Y. Vardi},

title = {Verification of Concurrent Programs: The Automata-Theoretic Framework},

booktitle = {Annals of Pure and Applied Logic},

year = {1987},

pages = {167--176}

}

### Years of Citing Articles

### OpenURL

### Abstract

We present an automata-theoretic framework to the verification of concurrent and nondeterministic programs. The basic idea is that to verify that a program P is correct one writes a program A that receives the computation of P as input and diverges only on incorrect computations of P . Now P is correct if and only if a program PA , obtained by combining P and A, terminates. We formalize this idea in a framework of !-automata with a recursive set of states. This unifies previous works on verification of fair termination and verification of temporal properties. 1 Introduction In this paper we present an automata-theoretic framework that unifies several trends in the area of concurrent program verification. The trends are temporal logic, model checking, automata theory, and fair termination. Let us start with a survey of these trends. In 1977 Pnueli suggested the use of temporal logic in the verification of concurrent programs [Pn77]. The basic motivation is that in the verificat...

### Citations

1402 |
A discipline of programming
- Dijkstra
- 1976
(Show Context)
Citation Context ...This is the essence of Vardi and Wolper's approach to the verification of finite-state programs [Va85,VW86]. Example 4.3: Let P be the following program written in Dijkstra's guarded command language =-=[Di76]: n / 0; D-=-O true \Gamma! n / n + 1; uttrue \Gamma! n / \Gamman OD; The correctness condition \Psi is that eventually n becomes negative, or formally, F (n ! 0), where F is the "evevtually" connective ... |

1213 |
The temporal logic of programs
- Pnueli
- 1977
(Show Context)
Citation Context ...logic, model checking, automata theory, and fair termination. Let us start with a survey of these trends. In 1977 Pnueli suggested the use of temporal logic in the verification of concurrent programs =-=[Pn77]-=-. The basic motivation is that in the verification of concurrent programs it is easier to reason about computation sequences than about input-output relations. Temporal logic is a modal logic that ena... |

837 |
Theory of Recursive Functions and Effective Computability
- Rogers
- 1967
(Show Context)
Citation Context ...e w(0) \Delta \Delta \Delta w(i). A language is a set of words, i.e., a subset of ! ! . A language L is \Sigma 1 1 if there is an arithmetical relation R ` ! ! \Theta ! ! such that L = fw j 9uR(w;u)g =-=[Ro67]-=-. Kleene's Normal Form Theorem states that a language L is \Sigma 1 1 if and only if there is a recursive relation R ` ! \Theta ! such that L = fw j 9u8nR(w(n); u(n))g [Ro67]. 3 A table T is a tuple (... |

656 | Concurrency and automata on infinite sequences - Park - 1981 |

586 | An automata-theoretic approach to automatic program verification, in - Vardi, Wolper - 1986 |

330 |
The complexity of propositional linear temporal logics
- Sistla, Clarke
- 1985
(Show Context)
Citation Context ...hown by Pnueli [Pn77], that verifying arbitrary temporal properties of finite-state programs is decidable. More efficient algorithms were developed in [CES86, LP85, QS83] (lower bounds were proven in =-=[SC85]-=-). These algorithms are called model-checking algorithms, since they check whether the program is a model of its specification. The relevance of automata theory to the verification of concurrent progr... |

271 | Automatic verification of finite-- state concurrent systems using temporal logic specifications - Clarke, Emerson, et al. - 1986 |

231 |
Introduction to Logic
- Rescher
- 1964
(Show Context)
Citation Context ...oncurrent programs it is easier to reason about computation sequences than about input-output relations. Temporal logic is a modal logic that enables one to describe how a situation changes over time =-=[RU71]-=-. Hence, it is appropriate for reasoning about concurrent programs. Since 1977, there has been significant progress in the development of techniques and methodologies for proving temporal properties o... |

215 | Automatic verification of probabilistic concurrent finite state programs - Vardi - 1985 |

199 |
Temporal logic can be more expressive
- Wolper
- 1983
(Show Context)
Citation Context ...The relevance of automata theory to the verification of concurrent programs was recognized by Park [Pa79,Pa81b] and Nivat [Ni82]. The trend of "getting away" from temporal logic was started =-=by Wolper [Wo83]-=-, who argued the temporal logic lacks expressive power, and introduced extended temporal logic (ETL), which uses finite-state !-automata as a specification language. This trend was continued by Vardi ... |

148 | The temporal semantics of concurrent programs - Pnueli - 1981 |

141 | Proving liveness properties of concurrent programs - Owicki, Lamport - 1982 |

139 |
On a decision method in restricted second-order arithmetic
- Büchi
- 1962
(Show Context)
Citation Context ...I = ! or I is a natural number. Two automata A and A 0 are equivalent when L ! (A) = L ! (A 0 ). The above definitions generalize the definitions given in [VW88] of finite-state Wolper automata, 1 in =-=[Bu62]-=- of finite-state Buchi automata, and in [St82] of finite-state Streett automata. Clearly, a Wolper automaton T = (S; S 0 ; ff) is equivalent to the Buchi automatons(T; S). Also, a Buchi automaton (T; ... |

131 | The complementation problem for Büchi automata with applications to temporal logic - Sistla, Vardi, et al. - 1987 |

117 |
Expressing interesting properties of programs in propositional temporal logic
- Wolper
- 1986
(Show Context)
Citation Context ...mata are not determinizable, since determinizability would imply closure under complement. 2.3 Recursive Temporal Logic Wolper introduced an infinitary version of temporal logic, which he called IPTL =-=[Wo86]-=-. We define here recursive infinitary temporal logic RITL, which is the effective fragment of IPTL. Let ` 0 ; ` 1 ; : : : be a recursive sequence of predicates on !. (That is, ` i 2 2 ! and the relati... |

73 |
Countable nondeterminism and random assignment
- Apt, Plotkin
- 1986
(Show Context)
Citation Context ...at P admits no infinite computation that obeys ' if and only if P 0 admits no infinite computation [DH86,Ha86]. Since we know how to prove termination by reduction to an underlying assertion language =-=[AP86]-=-, Harel's method provide a reduction 2 technique for fair termination. Another approach to fair termination is the method of helpful directions [GFMR85, LPS81]. The main idea of this approach is to de... |

60 | Ten years of Hoare’s logic: A survey - Apt - 1981 |

60 | On the semantics of fair parallelism - Park - 1980 |

52 | A.: “How to cook a temporal proof system for your pet language - Manna, Pnueli - 1983 |

44 | Checking that finite-state concurrent programs satisfy their linear specification - Lichtenstein, Pnueli - 1985 |

42 | Verification of concurrent programs: A temporal proof system - Manna, Pnueli - 1983 |

42 | Fairness and Related Properties in Transition Systems - A Temporal Logic to Deal with Fairness - Queille, Sifakis |

41 |
Propositional dynamic logic of looping and converse
- Streett
- 1982
(Show Context)
Citation Context ... and A 0 are equivalent when L ! (A) = L ! (A 0 ). The above definitions generalize the definitions given in [VW88] of finite-state Wolper automata, 1 in [Bu62] of finite-state Buchi automata, and in =-=[St82]-=- of finite-state Streett automata. Clearly, a Wolper automaton T = (S; S 0 ; ff) is equivalent to the Buchi automatons(T; S). Also, a Buchi automaton (T; F ) is equivalent to the Streett automaton (T;... |

35 |
Theories of automata on !-tapes: a simplified approach
- Choueka
- 1974
(Show Context)
Citation Context ...so, a Buchi automaton (T; F ) is equivalent to the Streett automaton (T; f(S; F )g). It is well known that finite-state Buchi automata and finite-state Streett automata have the same expressive power =-=[Ch74]-=-, which is stronger than the expressive power of finite-state Wolper automata [VW88]. The proofs of both facts, the inequivalence of finite-state Wolper and Buchi automata and the equivalence of finit... |

28 |
Specification and verification of concurrent programs by 8automata
- Manna, Pnueli
- 1987
(Show Context)
Citation Context ...sentially, their method is to "get away" from temporal logic, since it seems difficult to directly verify properties specified in temporal logic. Alpern and Schneider [AS85,AS87] and Manna a=-=nd Pnueli [MP87]-=- continued this trend. They describe a proof by reduction method for properties (of arbitrary programs) specified by finite-state automata. At the same time, a lot of attention has been given to the d... |

27 | Effective transformations on infinite trees, with applications to high undecidability, dominoes, and fairness
- Harel
(Show Context)
Citation Context ...81a]. The main idea of this approach is to reduce fair termination to ordinary termination by augmenting the program with random assignments. A unifying treatment of this method was given by Harel in =-=[Ha86]-=- and pursued in [DH86]. Harel introduced an infinitary language L in which one can express almost all notions of fairness that have appeared in the literature. He then showed how fair termination can ... |

27 | Propositional dynamic logic of nonregular programs
- Harel, Pnueli, et al.
- 1983
(Show Context)
Citation Context ... recursive avoiding trees and recursive well-founded trees. Now, it is known that the set of (notations for) recursive well-founded trees is \Pi 1 1 -complete [Ro67]. Also, it follows from results in =-=[HPS83]-=- that the sets of recursive recurrence-free trees and recursive avoiding trees are \Pi 1 1 -complete. Thus, by definition, the sets of recursive well-founded trees, the set of recursive recurrence-fre... |

19 | Modular verification of computer communication protocols - Hailpern, Owicki - 1993 |

15 | Proof rules and transformations dealing with fairness - Apt, Olderog - 1983 |

15 | Proving boolean combinations of deterministic properties - Alpern, Schneider - 1987 |

13 |
Reasoning about infinite computation paths
- Vardi, Wolper
- 1983
(Show Context)
Citation Context ...pproach to model checking. They use the fact that one can effectively translate a temporal specification into an equivalent specification by a finite-state automaton over infinite execution sequences =-=[VW88]-=-. Vardi and Wolper have shown how by combining the finite-state program and the finite-state specification, the verification problem can be reduced to an automata-theoretic problem. Essentially, their... |

12 |
Hierarchies of recursive !-languages
- Staiger
- 1986
(Show Context)
Citation Context ...s. 2.2 Automata-Theoretic Reductions We first show that every \Sigma 1 1 language is definable by a Wolper automaton. (This theorem was observed by G. Plotkin. It is closely related to the results in =-=[WS77]-=-.) Theorem 2.1: Let L be a \Sigma 1 1 language. Then there is a Wolper automaton T such that L = L ! (A). 1 Wolper automata are called looping automata in [VW88]. 4 Proof: We use Kleene's Normal Form ... |

11 |
Verifying Temporal Properties without using Temporal Logic
- Alpern, Schneider
- 1985
(Show Context)
Citation Context ... to verify thatsand ae satisfies the conditions of the theorem. Note that we have not assigned ranks to programs states, but rather to pairs consisting of a program state and an automaton state as in =-=[AS85]-=-. Alternatively, one can associate a rank predicate with each state of A \Phi;\Psi in the spirit of [FRG85]. This would be practical if A \Phi;\Psi is finite state. Theorem 4.4 extends the results in ... |

9 | A proof rule for fair termination of guarded commands - Grumberg, Francez, et al. - 1985 |

8 | A weaker precondition for loops - Boom - 1982 |

7 |
Pnuelli ; Proving precedence properties: The temporal way
- Manna, Amir
- 1983
(Show Context)
Citation Context ... reader should compare this rule with Method M for impartial termination in [LPS81]. Example 4.6 : Precedence Properties: Precedence properties specify the desired order of events along a computation =-=[MP83b]. A preced-=-ence property is expressed by the temporal formula G(' ! ' 1 U(' 2 U : : : ' n ) : : :)), where U is the "unless" connective. 7 The property holds for a computation w if for all is0, if w i ... |

6 |
Fairness: The Ethics of Concurrent Termination
- Lehmann, Pnueli, et al.
- 1981
(Show Context)
Citation Context ...p + 1; ) holds for somes, ffl for all u; v 2 W , if ae(u; n; ) holds, and (u; v) 2 R, then ae(v; 0; ) holds for somes! . The reader should compare this rule with Method M for impartial termination in =-=[LPS81]-=-. Example 4.6 : Precedence Properties: Precedence properties specify the desired order of events along a computation [MP83b]. A precedence property is expressed by the temporal formula G(' ! ' 1 U(' 2... |

5 | Fair termination revisited with delay - Apt, Pnueli, et al. - 1984 |

5 |
A.: On Verifying That A Concurrent Program Satisfies A Nondeterministic Specification
- Sistla
- 1989
(Show Context)
Citation Context ...recursive automata. In fact, if \Phi is given by a recursive 12 automaton, then the complexity of the verification problem is \Pi 1 2 , which means that our verification techniques are not applicable =-=[Si88]-=-. Indeed, Manna and Pnueli's decision to use 8-automata [MP87], which are essentially Buchi automata that specify incorrectness, was influenced by an early exposition of the ideas in this paper. Thus,... |

3 |
Fair termination with cruel schedulers
- Dayan, Harel
- 1986
(Show Context)
Citation Context ... this approach is to reduce fair termination to ordinary termination by augmenting the program with random assignments. A unifying treatment of this method was given by Harel in [Ha86] and pursued in =-=[DH86]-=-. Harel introduced an infinitary language L in which one can express almost all notions of fairness that have appeared in the literature. He then showed how fair termination can be reduced to terminat... |

3 |
Infinite trees, markings and wellfoundedness
- Rinat, Francez, et al.
- 1988
(Show Context)
Citation Context ...nded sets. This ranking has to decrease along a computation according to rules that depends on the notion of fairness under consideration. A uniform treatment of this method was given by Rinat et al. =-=[RFG88]-=-. They introduced a proof rule for arbitrary fairness properties expressed in a fragment L \Gamma of Harel's L. The automata-theoretic framework that we present here unifies all the trends mentioned a... |

1 | A.: Adequate proof principles for invariance and liveness of concurrent programs - Manna, Pnueli |

1 | A predicate transformer for weak fair termination - Park - 1981 |

1 |
Fairness, marked trees, and automata. Unpublished manuscript
- Sistla
- 1986
(Show Context)
Citation Context ...v 2 W and p; q 2 S, if ae(u; p; ) holds, (u; v) 2 R, (p; u; q) 2 ff, and p 2 F , then ae(v; q; ) holds for somes! . 6 For a related automata-theoretic treatment of the helpful-directions approach see =-=[Si86]-=-. 15 Proof: By Theorem 4.1 we know that P is correct with respect to (\Phi; \Psi) if and only if P \Phi;\Psi = (W \Theta S; I \Theta S 0 ; R ff ) fairly terminates with respect to (W \Theta F ). So it... |