Finite Labelled Transition Systems Research Articles

Enforcing Opacity in Modular Systems

In discrete-event systems, the opacity of a secret ensures that some behaviors or states cannot be inferred with certainty from partial observation of the system. Enforcing opacity in a discrete-event system, encoded by a finite labelled transition system (LTS), is a way to avoid information leakage. Checking opacity is decidable but costly (EXPTIME in the worst cases). This paper addresses opacity for modular systems in which every module, represented by an LTS, has to protect its own secret (a set of secret states S) w.r.t. a local attacker. Once the system is composed, we assume a coalition between the attackers that share their local view (called the global attacker). Assuming the global attacker can observe all interactions between modules, we provide a reduced-complexity opacity verification technique and an algorithm for constructing local controllers that enforces opacity for each secret separately.

Observability of Finite Labeled Transition Systems

Finite labeled transition systems are nondeterministic and nontotal systems with finitely many inputs, states, and outputs. This paper provides algorithms for verifying the observability of finite labeled transition systems in the so-called multiple-experiment case, the simple-experiment case, and the arbitrary-experiment case, respectively, where these algorithms run in exponential time, exponential time, and quartic polynomial time, respectively, and are more effective than the existing algorithms in the literature.

State space axioms for T-systems

T-systems are generalisations of marked graph Petri nets. This paper describes synthesis algorithms that allow bounded or unbounded T-systems to be derived from finite or infinite labelled transition systems satisfying a set of necessary properties. These properties can thus be interpreted as axioms characterising T-system state spaces.

Checking Opacity of Vulnerable Critical Systems On-The-Fly

Opacity is a security property capturing a system's ability to keep a subset of its behavior hidden from passive, but knowledgeable, observers. In this paper we use the formal definitions of opacity in three of its forms (simple opacity, -step weak opacity and -step strong opacity), basing on finite Labeled Transition Systems as a model. Then we present efficient algorithms for verifying opacity in all these forms within the context of a hybrid, on-the-fly approach. This approach is based on the construction of a Symbolic Observation Graph (SOG) that allows not only the abstraction of the systems behavior but also the preservation of the structure necessary for conducting opacity checking. Our preliminary experimental results are promising and demonstrate effectiveness facing the state-explosion problem which represents the main drawback of existing model checking techniques.

Finite Abstractions of Max-Plus-Linear Systems

This work puts forward a novel technique to generate finite abstractions of autonomous and nonautonomous Max-Plus-Linear (MPL) models, a class of discrete-event systems used to characterize the dynamics of the timing related to successive events that synchronize autonomously. Nonautonomous versions of MPL models embed within their dynamics nondeterminism, namely a signal choice that is usually regarded as an exogenous control or schedule. In this paper, abstractions of MPL models are characterized as finite-state Labeled Transition Systems (LTS). LTS are obtained first by partitioning the state space (and, for the nonautonomous model, by covering the input space) of the MPL model and by associating states of the LTS to the introduced partitions, then by defining relations among the states of the LTS based on dynamical transitions between the corresponding partitions of the MPL state space, and finally by labeling the LTS edges according to the one-step timing properties of the events of the original MPL model. In order to establish formal equivalences, the finite abstractions are proven to either simulate or to bisimulate the original MPL model. This approach enables the study of general properties of the original MPL model by verifying (via model checking) equivalent logical specifications over the finite LTS abstraction. The computational aspects related to the abstraction procedure are thoroughly discussed and its performance is tested on a numerical benchmark.

All Linear-Time Congruences for Familiar Operators

The detailed behaviour of a system is often represented as a labelled transition system (LTS) and the abstract behaviour as a stuttering-insensitive semantic congruence. Numerous congruences have been presented in the literature. On the other hand, there have not been many results proving the absence of more congruences. This publication fully analyses the linear-time (in a well-defined sense) region with respect to action prefix, hiding, relational renaming, and parallel composition. It contains 40 congruences. They are built from the alphabet, two kinds of traces, two kinds of divergence traces, five kinds of failures, and four kinds of infinite traces. In the case of finite LTSs, infinite traces lose their role and the number of congruences drops to 20. The publication concentrates on the hardest and most novel part of the result, that is, proving the absence of more congruences.

Characteristic formulae for fixed-point semantics: a general framework

The concurrency theory literature offers a wealth of examples of characteristic-formula constructions for various behavioural relations over finite labelled transition systems and Kripke structures that are defined in terms of fixed points of suitable functions. Such constructions and their proofs of correctness have been developed independently, but have a common underlying structure. This paper provides a general view of characteristic formulae that are expressed in terms of logics that have a facility for the recursive definition of formulae. We show how several examples of characteristic-formula constructions in the literature can be recovered as instances of the proposed general framework, and how the framework can be used to yield novel constructions. The paper also offers general results pertaining to the definition of co-characteristic formulae and of characteristic formulae expressed in terms of infinitary modal logics.

Characteristic Formulae for Fixed-Point Semantics: A General Framework

The literature on concurrency theory offers a wealth of examples of characteristic-formula constructions for various behavioural relations over finite labelled transition systems and Kripke structures that are defined in terms of fixed points of suitable functions. Such constructions and their proofs of correctness have been developed independently, but have a common underlying structure. This study provides a general view of characteristic formulae that are expressed in terms of logics with a facility for the recursive definition of formulae. It is shown how several examples of characteristic-formula constructions from the literature can be recovered as instances of the proposed general framework, and how the framework can be used to yield novel constructions.

Automating the addition of fault tolerance with discrete controller synthesis

Discrete controller synthesis (DCS) is a formal approach, based on the same state-space exploration algorithms as model-checking. Its interest lies in the ability to obtain automatically systems satisfying by construction formal properties specified a priori. In this paper, our aim is to demonstrate the feasibility of this approach for fault tolerance. We start with a fault intolerant program, modeled as the synchronous parallel composition of finite labeled transition systems; we specify formally a fault hypothesis; we state some fault tolerance requirements; and we use DCS to obtain automatically a program, having the same behavior as the initial fault intolerant one in the absence of faults, and satisfying the fault tolerance requirements under the fault hypothesis. Our original contribution resides in the demonstration that DCS can be elegantly used to design fault tolerant systems, with guarantees on key properties of the obtained system, such as the fault tolerance level, the satisfaction of quantitative constraints, and so on. We show with numerous examples taken from case studies that our method can address different kinds of failures (crash, value, or Byzantine) affecting different kinds of hardware components (processors, communication links, actuators, or sensors). Besides, we show that our method also offers an optimality criterion very useful to synthesize fault tolerant systems compliant to the constraints of embedded systems, like power consumption.

Special issue on learning techniques for compositional reasoning

This special issue of Formal Methods in System Design (FMSD) was initiated by Professor Ed Clarke and contains a selection of articles on using learning techniques to automate compositional verification in the assume-guarantee style. Model checking is an automated verification technique that can be used to determine whether a concurrent system satisfies certain properties. It works by systematically exploring all the system states, which is intractable for most systems of realistic size, a limitation known as the “state-explosion problem”. Compositional verification has been identified as a promising approach for alleviating state explosion in model checking. This technique decomposes the verification task for the system into simpler verification problems for the individual components of the system. In checking components individually, assume-guarantee reasoning introduces assumptions, which incorporate knowledge of the contexts in which each component is expected to operate. Assumptions have traditionally been defined manually, which has limited the practical impact of assume-guarantee reasoning. Over the last decade, researchers have focused on the automated generation of assumptions for assume-guarantee reasoning. The papers included in this issue all present solutions to automated assumption generation based on learning. The order in which they appear is chronological, based on the publication of the original conference articles that they extend. The first article, “Learning to Divide and Conquer: Applying the L* Algorithm to Automate Assume-Guarantee Reasoning”, outlines the assume guarantee framework that uses the L* learning algorithm to automatically build assumptions, as originally proposed in [3], and presents extensions with symmetric rules and alphabet refinement. While the first article deals with components described as finite labeled transition systems in the context of

Deciding orthogonal bisimulation

Abstract Bergstra, Ponse and van der Zwaag introduced in 2003 the notion of orthogonal bisimulation equivalence on labeled transition systems. This equivalence is a refinement of branching bisimulation, in which consecutive tau’s (silent steps) can be compressed into one (but not zero) tau’s. The main advantage of orthogonal bisimulation is that it combines well with priorities. Here we solve the problem of deciding orthogonal bisimulation equivalence in finite (regular) labeled transition systems. Unlike as in branching bisimulation, in orthogonal bisimulation, cycles of silent steps cannot be eliminated. Hence, the algorithm of Groote and Vaandrager (1990) cannot be adapted easily. However, we show that it is still possible to decide orthogonal bisimulation with the same complexity as that of Groote and Vaandrager’s algorithm. Thus if n is the number of states, and m the number of transitions then it takes O ( n ( m + n )) time to decide orthogonal bisimilarity on finite labeled transition systems, using O ( m + n ) space.

State space generation for the HAVi leader election protocol

This paper describes two specifications of the leader election protocol from the home audio/video interoperability (HAVi) architecture. The specifications were written in two concurrent specification languages: μCRL and PROMELA. Two toolsets allowing generation of finite labeled transition systems, for μCRL and PROMELA, respectively, were applied in this case study. The results of the state space generation by both tools and some conclusions on the semantical differences between PROMELA and μCRL are presented in this paper.

Automatic verification for a class of distributed systems

The paper presents a new analysis method for a class of concurrent systems which are formed of several interacting components with the same structure. The model for these systems is composed of a control process and a set of homogeneous user processes. The control and user processes are modeled by finite labeled state transition systems which interact by means of enabling functions and triggering mechanisms. Based on this structure, an analysis method is presented which allows system properties, derived by reachability analysis for a finite number of user processes, to be generalized to an arbitrary number of user processes. A procedure for the automatic verification of properties such as mutual exclusion and absence of deadlocks is presented and is then used to provide for the first time a fully automated verification of the Lamport's fast mutual exclusion algorithm.

Testing Algebraic Data Types and Processes: A Unifying Theory

Abstract. There is now a lot of interest in program testing based on formal specifications. However, most the works in this area focus on one formalized aspect of the software under test. For instance, some previous works of the first author consider abstract data type specifications. Other works are based on behavioural descriptions, such as finite state machines or finite labelled transition systems. This paper begins by brie y recalling the principles of test data selection from algebraic data types specifications. Then, it transposes them to basic and full LOTOS. Finally it exploits this uniform framework and suggests a new integrated approach to test derivation from full LOTOS specifications, where both behavioural properties and data types properties are taken into account when dealing with processes.

GSOS and finite labelled transition systems

Recently there has been considerable interest in studying formats of Plotkin style inference rules which ensure that the induced labelled transition system semantics have certain properties. In this note, I shall give a contribution to this line of research by giving a restricted version of Bloom, Istrail and Meyer's GSOS format Bloom et al. (1988), Bloom (1989) which induces finite labelled transition systems.

A static view of localities

Abstract This paper proposes alternative, effective characterizations for nets of automata of the location equivalence and preorder presented by Boudol et al. in the companion paper [BCHK]. Contrary to the technical development in the above given reference, where locations are dynamically associated to the subparts of a process in the operational semantics, the equivalence and preorder we propose are based on a static association of locations to the parallel components of a net. Following this static approach, it is possible to give these “distributed nets” a standard operational semantics which associates with each net a finite labelled transition system. Using this operational semantics for distributed nets, we introduce effective notions of equivalence and preorder which are shown to coincide with those proposed in [BCHK].

Strong fairness and ultra metrics

We answer an open question of Costa and Hennessy and present a characterization of the infinite fair computations in finite labeled transition systems—without any structure of the states—as cluster points in metric spaces. This technique is applied to reduce the logical complexity of several known fairness concepts from Π 0 3 to Π 0 2 and from Σ 1 1 to Π 0 3, respectively.