## Environment abstraction for parameterized verification (2006)

Venue: | In 7 th VMCAI, LNCS 3855 |

Citations: | 19 - 1 self |

### BibTeX

@INPROCEEDINGS{Clarke06environmentabstraction,

author = {Edmund Clarke and Muralidhar Talupur and Helmut Veith},

title = {Environment abstraction for parameterized verification},

booktitle = {In 7 th VMCAI, LNCS 3855},

year = {2006},

pages = {126--141},

publisher = {Springer}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. Many aspects of computer systems are naturally modeled as parameterized systems which renders their automatic verification difficult. In wellknown examples such as cache coherence protocols and mutual exclusion protocols, the unbounded parameter is the number of concurrent processes which run the same distributed algorithm. In this paper, we introduce environment abstraction as a tool for the verification of such concurrent parameterized systems. Environment abstraction enriches predicate abstraction by ideas from counter abstraction; it enables us to reduce concurrent parameterized systems with unbounded variables to precise abstract finite state transition systems which can be verified by a finite state model checker. We demonstrate the feasibility of our approach by verifying the safety and liveness properties of Lamport’s bakery algorithm and Szymanski’s mutual exclusion algorithm. To the best of our knowledge, this is the first time both safety and liveness properties of the bakery algorithm have been verified at this level of automation. 1

### Citations

599 | Construction of abstract state graphs with PVS
- Graf, Saïdi
- 1997
(Show Context)
Citation Context ...e bakery algorithm have been verified at this level of automation. 1 Introduction We propose a new method for the verification of concurrent parameterized systems which combines predicate abstraction =-=[21]-=- with ideas from counter abstraction [29]. In predicate abstraction, the memory state of a system is approximated by a tuple of Boolean values which indicate whether certain properties (“predicates”) ... |

215 |
A new solution of dijkstra’s concurrent programming problem
- Lamport
- 1974
(Show Context)
Citation Context ...ng the abstraction method described here, we have been able to verify automatically the safety and liveness properties of two well known mutual exclusion algorithms, namely Lamport’s Bakery algorithm =-=[26]-=- and Szymanski’s algorithm [31]. While safety and liveness properties of Szymanski’s algorithm have been automatically verified with atomicity assumption by Baukus et al [5], this is the first time bo... |

166 | Symmetry and model checking
- Emerson, Sistla
- 1996
(Show Context)
Citation Context ...oblem have been developed over the years, including the use of symbolic automata-based techniques [1, 23, 8, 7], invariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry =-=[11, 14, 17, 15, 16]-=-. Some of the earliest work on verifying parameterized systems includes works by Browne et al [9], German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on ... |

128 | Reasoning about systems with many processes
- German, Sistla
- 1992
(Show Context)
Citation Context ...es [3, 28], predicate abstraction [24], or exploiting symmetry [11, 14, 17, 15, 16]. Some of the earliest work on verifying parameterized systems includes works by Browne et al [9], German and Sistla =-=[20]-=-, Emerson and Sistla [16]. In the rest of this section, we will concentrate on the work which is closest to our approach. Counter Abstraction [4, 12, 13, 29, 20] is an intuitive method to use on param... |

124 | Abstract regular model checking
- Bouajjani, Habermehl, et al.
(Show Context)
Citation Context ... parameterized systems is well known to be undecidable [2, 30]. Many interesting approaches to this problem have been developed over the years, including the use of symbolic automata-based techniques =-=[1, 23, 8, 7]-=-, invariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry [11, 14, 17, 15, 16]. Some of the earliest work on verifying parameterized systems includes works by Browne et ... |

94 | Reasoning about networks with many identical finite state processes
- Clarke, Grumberg, et al.
- 1989
(Show Context)
Citation Context ...nvariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry [11, 14, 17, 15, 16]. Some of the earliest work on verifying parameterized systems includes works by Browne et al =-=[9]-=-, German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on the work which is closest to our approach. Counter Abstraction [4, 12, 13, 29, 20] is an intuitiv... |

90 | Symbolic model checking with rich assertional languages,” in Computer Aided Verification
- Kesten, Maler, et al.
- 1997
(Show Context)
Citation Context ... parameterized systems is well known to be undecidable [2, 30]. Many interesting approaches to this problem have been developed over the years, including the use of symbolic automata-based techniques =-=[1, 23, 8, 7]-=-, invariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry [11, 14, 17, 15, 16]. Some of the earliest work on verifying parameterized systems includes works by Browne et ... |

73 | Automatic deductive verification with invisible invariants,” Tools and Algorithms for the Construction and Analysis of Systems
- Pnueli, Ruah, et al.
- 2001
(Show Context)
Citation Context ... undecidable [2, 30]. Many interesting approaches to this problem have been developed over the years, including the use of symbolic automata-based techniques [1, 23, 8, 7], invariant based techniques =-=[3, 28]-=-, predicate abstraction [24], or exploiting symmetry [11, 14, 17, 15, 16]. Some of the earliest work on verifying parameterized systems includes works by Browne et al [9], German and Sistla [20], Emer... |

66 | Utilizing symmetry when model-checking under fairness assumptions
- Emerson, Sistla
- 1997
(Show Context)
Citation Context ...oblem have been developed over the years, including the use of symbolic automata-based techniques [1, 23, 8, 7], invariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry =-=[11, 14, 17, 15, 16]-=-. Some of the earliest work on verifying parameterized systems includes works by Browne et al [9], German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on ... |

63 | Parameterized verification with automatically computed inductive assertions
- Arons, Pnueli, et al.
- 2001
(Show Context)
Citation Context ...ting e.g. a guard, no other process makes any transition. This simplification – which we shall call the atomicity assumption further on – is implicit in other works on parameterized verification, see =-=[3, 5, 6, 29]-=-. 2sFigure 1 visualizes the intuition underlying environment abstraction. The grey box on the left hand side represents a concrete state of a system with 16 concurrent processes. The different colors ... |

45 | Indexed predicate discovery for unbounded system verification
- Lahiri, Bryant
- 2004
(Show Context)
Citation Context ...e naturally generalized for additional constructs as well. To handle liveness we augment the abstract model using an approach suggested by [29]. Note that in contrast to the indexed predicates method =-=[24, 25]-=-, our approach constructs an abstract transition system, instead of computing the set of reachable abstract states. This feature of our approach is crucial for verifying liveness properties. Tool Chai... |

26 | Abstracting WS1S Systems to Verify Parameterized Networks
- Baukus, Bensalem, et al.
- 2000
(Show Context)
Citation Context ...ting e.g. a guard, no other process makes any transition. This simplification – which we shall call the atomicity assumption further on – is implicit in other works on parameterized verification, see =-=[3, 5, 6, 29]-=-. 2sFigure 1 visualizes the intuition underlying environment abstraction. The grey box on the left hand side represents a concrete state of a system with 16 concurrent processes. The different colors ... |

26 |
P.: Iterating transducers in the large
- Boigelot, Legay, et al.
- 2003
(Show Context)
Citation Context ... parameterized systems is well known to be undecidable [2, 30]. Many interesting approaches to this problem have been developed over the years, including the use of symbolic automata-based techniques =-=[1, 23, 8, 7]-=-, invariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry [11, 14, 17, 15, 16]. Some of the earliest work on verifying parameterized systems includes works by Browne et ... |

25 | Parameterized verification of multithreaded software libraries
- Ball, Chaki, et al.
- 2001
(Show Context)
Citation Context ...includes works by Browne et al [9], German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on the work which is closest to our approach. Counter Abstraction =-=[4, 12, 13, 29, 20]-=- is an intuitive method to use on parameterized systems. Pnueli et al [29] who coined the term counter abstraction show how systems composed of symmetric and finite state processes can be handled auto... |

24 | Induction and compositional model checking
- McMillan, Qadeer, et al.
- 2000
(Show Context)
Citation Context ... this is an automatic technique it cannot handle protocols such as the Bakery algorithm which have unbounded integer variables. The global conditions are assumed to be atomic. The inductive method of =-=[27]-=- based on model checking is applied to verify both safety and liveness of the Bakery algorithm, notably without assuming atomicity. This approach however is not automatic: the user is required to prov... |

22 | Regular model checking made simple and efficient
- Abdulla, Jonsson, et al.
- 2002
(Show Context)
Citation Context |

18 |
Model checking guarded protocols
- Emerson, Kahlon
- 2003
(Show Context)
Citation Context ...includes works by Browne et al [9], German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on the work which is closest to our approach. Counter Abstraction =-=[4, 12, 13, 29, 20]-=- is an intuitive method to use on parameterized systems. Pnueli et al [29] who coined the term counter abstraction show how systems composed of symmetric and finite state processes can be handled auto... |

17 |
Liveness with (0, 1, ∞)-counter abstraction
- Pnueli, Xu, et al.
- 2002
(Show Context)
Citation Context ...this level of automation. 1 Introduction We propose a new method for the verification of concurrent parameterized systems which combines predicate abstraction [21] with ideas from counter abstraction =-=[29]-=-. In predicate abstraction, the memory state of a system is approximated by a tuple of Boolean values which indicate whether certain properties (“predicates”) of the memory state hold or not. For exam... |

16 | Liveness with invisible ranking
- FANG, PITERMAN, et al.
(Show Context)
Citation Context ...and the Bakery protocol in [29] requires manual introduction of new variables. The method also makes assumptions on the atomicity of guards. The Invisible Invariants method was introduced in a series =-=[28, 3, 18, 19]-=- of papers. The idea behind this technique is to find an invariant for the parameterized system by 4sexamining concrete systems for low valuations of the parameter(s). The considered system model is p... |

16 |
A Simple Solution to Lamport’s Concurrent Programming Problem with Linear Wait
- Szymanski
(Show Context)
Citation Context ...ibed here, we have been able to verify automatically the safety and liveness properties of two well known mutual exclusion algorithms, namely Lamport’s Bakery algorithm [26] and Szymanski’s algorithm =-=[31]-=-. While safety and liveness properties of Szymanski’s algorithm have been automatically verified with atomicity assumption by Baukus et al [5], this is the first time both safety and liveness of Lampo... |

13 | Verification of Parameterized Protocols
- Baukus, Lakhnech, et al.
- 2001
(Show Context)
Citation Context ...ting e.g. a guard, no other process makes any transition. This simplification – which we shall call the atomicity assumption further on – is implicit in other works on parameterized verification, see =-=[3, 5, 6, 29]-=-. 2sFigure 1 visualizes the intuition underlying environment abstraction. The grey box on the left hand side represents a concrete state of a system with 16 concurrent processes. The different colors ... |

11 |
Automated verification of cache coherence protocols
- Delzanno
- 2000
(Show Context)
Citation Context ...includes works by Browne et al [9], German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on the work which is closest to our approach. Counter Abstraction =-=[4, 12, 13, 29, 20]-=- is an intuitive method to use on parameterized systems. Pnueli et al [29] who coined the term counter abstraction show how systems composed of symmetric and finite state processes can be handled auto... |

8 | Liveness with incomprehensible ranking
- Fang, Piterman, et al.
- 2004
(Show Context)
Citation Context ...and the Bakery protocol in [29] requires manual introduction of new variables. The method also makes assumptions on the atomicity of guards. The Invisible Invariants method was introduced in a series =-=[28, 3, 18, 19]-=- of papers. The idea behind this technique is to find an invariant for the parameterized system by 4sexamining concrete systems for low valuations of the parameter(s). The considered system model is p... |

7 |
From asymmetry to full symmetry
- Emerson, Trefler
- 1999
(Show Context)
Citation Context ...oblem have been developed over the years, including the use of symbolic automata-based techniques [1, 23, 8, 7], invariant based techniques [3, 28], predicate abstraction [24], or exploiting symmetry =-=[11, 14, 17, 15, 16]-=-. Some of the earliest work on verifying parameterized systems includes works by Browne et al [9], German and Sistla [20], Emerson and Sistla [16]. In the rest of this section, we will concentrate on ... |

7 | Proving properties of a ring of finite state machines - Suzuki - 1988 |

6 |
Constructing quantified invariants
- Lahiri, Bryant
- 2004
(Show Context)
Citation Context ...e naturally generalized for additional constructs as well. To handle liveness we augment the abstract model using an approach suggested by [29]. Note that in contrast to the indexed predicates method =-=[24, 25]-=-, our approach constructs an abstract transition system, instead of computing the set of reachable abstract states. This feature of our approach is crucial for verifying liveness properties. Tool Chai... |

5 |
Limits for automatic verification of finite state concurrent systems
- Apt, Kozen
- 1986
(Show Context)
Citation Context ...t’s bakery algorithm have been verified (with the atomicity assumption) at this level of automation. 2 Discussion of Related Work Verification of parameterized systems is well known to be undecidable =-=[2, 30]-=-. Many interesting approaches to this problem have been developed over the years, including the use of symbolic automata-based techniques [1, 23, 8, 7], invariant based techniques [3, 28], predicate a... |

4 |
Exploiting symmetry in temporal model checking
- Clarke, Filkorn, et al.
- 1993
(Show Context)
Citation Context |

3 |
Virtual Symmetry
- Emerson, Havlicek, et al.
- 2000
(Show Context)
Citation Context |

3 |
Race Checking with Context Inference
- Henzinger, Jhala, et al.
- 2004
(Show Context)
Citation Context ...ique is applicable to a wide variety of systems but it requires the user to express systems in terms of regular languages which is a non-trivial process and requires user ingenuity. Henzinger et. al. =-=[22]-=- also consider the problem of unbounded number of threads but the system model they consider is different. The communication between threads occurs through shared variables, whereas in our case, each ... |