Verification Of Liveness Properties Research Articles

Mostly Automated Verification of Liveness Properties for Distributed Protocols with Ranking Functions

Distributed protocols have long been formulated in terms of their safety and liveness properties. Much recent work has focused on automatically verifying the safety properties of distributed protocols, but doing so for liveness properties has remained a challenging, unsolved problem. We present LVR, the first framework that can mostly automatically verify liveness properties for distributed protocols. Our key insight is that most liveness properties for distributed protocols can be reduced to a set of safety properties with the help of ranking functions. Such ranking functions for practical distributed protocols have certain properties that make them straightforward to synthesize, contrary to conventional wisdom. We prove that verifying a liveness property can then be reduced to a simpler problem of verifying a set of safety properties, namely that the ranking function is strictly decreasing and nonnegative for any protocol state transition, and there is no deadlock. LVR automatically synthesizes ranking functions by formulating a parameterized function of integer protocol variables, statically analyzing the lower and upper bounds of the variables as well as how much they can change on each state transition, then feeding the constraints to an SMT solver to determine the coefficients of the ranking function. It then uses an off-the-shelf verification tool to find inductive invariants to verify safety properties for both ranking functions and deadlock freedom. We show that LVR can mostly automatically verify the liveness properties of several distributed protocols, including various versions of Paxos, with limited user guidance.

Temporal verification of higher-order functional programs

We present an automated approach to verifying arbitrary omega-regular properties of higher-order functional programs. Previous automated methods proposed for this class of programs could only handle safety properties or termination, and our approach is the first to be able to verify arbitrary omega-regular liveness properties. Our approach is automata-theoretic, and extends our recent work on binary-reachability-based approach to automated termination verification of higher-order functional programs to fair termination published in ESOP 2014. In that work, we have shown that checking disjunctive well-foundedness of (the transitive closure of) the ``calling relation'' is sound and complete for termination. The extension to fair termination is tricky, however, because the straightforward extension that checks disjunctive well-foundedness of the fair calling relation turns out to be unsound, as we shall show in the paper. Roughly, our solution is to check fairness on the transition relation instead of the calling relation, and propagate the information to determine when it is necessary and sufficient to check for disjunctive well-foundedness on the calling relation. We prove that our approach is sound and complete. We have implemented a prototype of our approach, and confirmed that it is able to automatically verify liveness properties of some non-trivial higher-order programs.

Combining Formal Methods for the Development of Reactive Systems

This article deals with the use of two verification approaches: theorem proving and model checking. We focus on the Event-B method by using its associated theorem proving tool (Click_n_Prove), and on the language TLA + by using its model checker TLC. By considering the limitation of the Event-B method to invariance properties, we propose to apply the language TLA + to verify liveness properties on a software behavior. We extend first the expressivity and the semantics of a B model (called temporal B model ) to deal with the specification of fairness and eventuality properties. Second, we give transformation rules from a temporal B model into a TLA + module. We present in particular, our prototype system called B2TLA + , that we have developed to support this transformation; then we can verify these properties thanks to the model checker TLC on finite state systems. For the verification of infinite-state systems, we propose the use of the predicate diagrams. We illustrate our approach on a case study of a parcel sorting system.

A formal approach for the development of reactive systems

Context This paper deals with the development and verification of liveness properties on reactive systems using the Event-B method. By considering the limitation of the Event-B method to invariance properties, we propose to apply the language TLA + to verify liveness properties on Event-B models. Objective This paper deals with the use of two verification approaches: theorem proving and model-checking, in the construction and verification of safe reactive systems. The theorem prover concerned is part of the Click_n_Prove tool associated to the Event-B method and the model checker is TLC for TLA + models. Method To verify liveness properties on Event-B systems, we extend first the expressivity and the semantics of a B model (called temporal B model) to deal with the specification of fairness and eventuality properties. Second, we propose semantics of the extension over traces, in the same spirit as TLA + does. Third, we give verification rules in the axiomatic way of the Event-B method. Finally, we give transformation rules from a temporal B model into a TLA + module. We present in particular, our prototype system called B2TLA +, that we have developed to support this transformation; then we can verify liveness properties thanks to the model checker TLC on finite state systems. For the verification of infinite-state systems, we propose the use of the predicate diagrams and its associated tool DIXIT. As the B refinement preserves invariance properties through refinement steps, we propose some rules to get the preservation of liveness properties by the B refinement. Results The proposed approach is applied for the development of some reactive systems examples and our prototype system B2TLA + is successfully used to transform a temporal B model into a TLA + module. Conclusion The paper successfully defines an approach for the specification and verification of safety and liveness properties for the development of reactive systems using the Event-B method, the language TLA + and the predicate diagrams with their associated tools. The approach is illustrated on a case study of a parcel sorting system.

Temporal Logic Analysis of Gene Netwroks Under parameter uncertainty

The lack of precise numerical information for the values of biological parameters severely limits the development and analysis of models of genetic regulatory networks. To deal with this problem, we propose a method for the analysis of genetic regulatory networks under parameter uncertainty. We consider models based on piecewise-multiaffine differential equations, dynamical properties expressed in temporal logic, and intervals for the values of uncertain parameters. The problem is then either to guarantee that the system satisfies the expected properties for every possible parameter value-the corresponding parameter set is then called valid-or to find valid subsets of a given parameter set. The proposed method uses discrete abstractions and model checking and allows for efficient search of the parameter space. However, the abstraction process creates spurious behaviors in the abstract systems, along which time does not progress. Consequently, the verification of liveness properties, expressing that something will eventually happen, and implicitly assuming progress of time, often fails. A solution to this second problem is proposed using the notion of transient regions. This approach has been implemented in a tool for robust verification of gene networks and applied to the tuning of a synthetic network built in <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">E. coli</i> .

Temporal Logic Analysis of Gene Networks Under Parameter Uncertainty

The lack of precise numerical information for the values of biological parameters severely limits the development and analysis of models of genetic regulatory networks. To deal with this problem, we propose a method for the analysis of genetic regulatory networks under parameter uncertainty. We consider models based on piecewise-multiaffine differential equations, dynamical properties expressed in temporal logic, and intervals for the values of uncertain parameters. The problem is then either to guarantee that the system satisfies the expected properties for every possible parameter value-the corresponding parameter set is then called valid-or to find valid subsets of a given parameter set. The proposed method uses discrete abstractions and model checking and allows for efficient search of the parameter space. However, the abstraction process creates spurious behaviors in the abstract systems, along which time does not progress. Consequently, the verification of liveness properties, expressing that something will eventually happen, and implicitly assuming progress of time, often fails. A solution to this second problem is proposed using the notion of transient regions. This approach has been implemented in a tool for robust verification of gene networks and applied to the tuning of a synthetic network built in E. coli.

임베디드 자바 프로그램의 정형 검증

임베디드 소프트웨어는 크기나 기능면에서 복잡하기 때문에 에러가 숨어있을 확률이 높다. 그래서 에러를 효과적으로 찾아낼 수 있는 방법이 절실히 요구된다. 임베디드 소프트웨어에서 잠재적인 오류를 찾아내는 기술중의 하나가 모델 체킹이며, 대표적인 연구로서 SLAM 이 있다. SLAM은 임베디드 C 프로그램의 안전성 속성을 검증하는 소프트웨어 모델 체킹 도구이다. 본 논문에서는 임베디드 자바 프로그램을 검증하는 모델 체킹 도구를 개발했다. SLAM과는 달리 자바 프로그램의 안전성뿐만 아니라 궁극성 속성을 모두 검증할 수 있다. 개발된 모델 체킹 도구를 이용하여 레고 로봇을 제어하는 임베디드 자바 프로그램의 속성을 검증하였다. There may be subtle errors in embedded software since its functionality is very complex. Thus formal verification for detecting them is very needed. Model checking is one of formal verification techniques, and SLAM is a well-known software model checking tool for verifying safety properties of embedded C program. In this paper, we develop a software model checker like SLAM for verifying embedded Java program Compared to SLAM, our tool allows to verify liveness properties as well as safety ones. As a result, we verify some desired properties in embedded Java program for controlling REGO robot.

Efficient reduction of finite state model checking to reachability analysis

Two types of temporal properties are usually distinguished: safety and liveness. Recently we have shown how to verify liveness properties of finite state systems using safety checking. In this article we extend the translation scheme to typical combinations of temporal operators. We discuss optimizations that limit the overhead of our translation. Using the notions of predicated diameter and radius we obtain revised bounds for our translation scheme. These notions also give a tight bound on the minimal completeness bound for simple liveness properties. Experimental results show the feasibility of the approach for complex examples. For one example, even an exponential speedup can be observed.

Simulating Liveness by Reduction Strategies

We define a general framework to handle liveness and related properties by reduction strategies in abstract reduction and term rewriting. Classically, reduction strategies in rewriting are used to simulate the evaluation process in programming languages. The aim of our work is to use reduction strategies to also study liveness questions which are of high importance in practice (e.g., in protocol verification for distributed processes). In particular, we show how the problem of verifying liveness is related to termination of term rewrite systems (TRSs). Using our results, techniques for proving termination of TRSs can be used to verify liveness properties.

Verifying liveness properties of multifunction composite protocols

In protocol composition techniques, component protocols are combined in various ways to obtain a complex protocol whose execution sequences consist of interleaved execution sequences of the component protocols. In this paper, we investigate the problem of verifying liveness properties of the composite protocol from the known properties of its components. We first characterize a class of composite protocols that encompasses almost every composite protocol appeared in the literature. For verifying liveness properties of a composite protocol in the class, we then develop a sufficient condition to ensure that certain liveness properties of the component protocols carry over to the composite protocol. A verification technique, based on this sufficient condition, is then used to determine whether the liveness properties of the component protocols also hold for the composite protocol. The technique is applicable to any transition based protocol model as long as the model is susceptible to reachability analysis for the sake of correctness proofs. To demonstrate the usefulness of our technique, we apply it to a class of protocols that involves certain synchronizing constraints. This work shows a promising integration of a synthesis technique with an analytic method.

Finitary fairness

Fairness is a mathematical abstraction: in a multiprogramming environment, fairness abstracts the details of admissible (“fair”) schedulers; in a distributed environment, fairness abstracts the relative speeds of processors. We argue that the standard definition of fairness often is unnecessarily weak and can be replaced by the stronger, yet still abstract, notion of finitary fairness. While standard weak fairness requires that no enabled transition is postponed forever, finitary weak fairness requires that for every computation of a system there is an unknown bound k such that no enabled transition is postponed more than k consecutive times. In general, the finitary restriction fin ( F ) of any given fairness requirement F is the union of all ω-regular safety properties contained in F . The adequacy of the proposed abstraction is shown in two ways. Suppose we prove a program property under the assumption of finitary fairness. In a multiprogramming environment, the program then satisfies the property for all fair finite-state schedulers. In a distributed environment, the program then satisfies the property for all choices of lower and upper bounds on the speeds (or timings) of processors. The benefits of finitary fairness are twofold. First, the proof rules for verifying liveness properties of concurrent programs are simplified: well-founded induction over the natural numbers is adequate to prove termination under finitary fairness. Second, the fundamental problem of consensus in a faulty asynchronous distributed environment can be solved assuming finitary fairness.

Verification of liveness properties using compositional reachability analysis

Verification of liveness properties using compositional reachability analysis

A simple approach to specifying concurrent systems

A simple approach to specifying concurrent systems