Well-structured Transition Systems Research Articles

What’s Decidable About Causally Consistent Shared Memory?

While causal consistency is one of the most fundamental consistency models weaker than sequential consistency, the decidability of safety verification for (finite-state) concurrent programs running under causally consistent shared memories is still unclear. In this article, we establish the decidability of this problem for two standard and well-studied variants of causal consistency. To do so, for each variant, we develop an equivalent “lossy” operational semantics, whose states track possible futures, rather than more standard semantics that record the history of the execution. We show that these semantics constitute well-structured transition systems, thus enabling decidable verification. Based on a key observation, which we call the “shared-memory causality principle,” the two novel semantics may also be of independent use in the investigation of weakly consistent models and their verification. Interestingly, our results are in contrast to the undecidability of this problem under the Release/Acquire fragment of the C/C++11 memory model, which forms another variant of causally consistent memory that, in terms of allowed outcomes, lies strictly between the two models studied here. Nevertheless, we show that all these three variants coincide for write/write-race-free programs, which implies the decidability of verification for such programs under Release/Acquire.

Resilience of Well-structured Graph Transformation Systems

Resilience is a concept of rising interest in computer science and software engineering. For systems in which correctness w.r.t. a safety condition is unachievable, fast recovery is demanded. We investigate resilience problems of graph transformation systems. Our main contribution is the decidability of two resilience problems for well-structured graph transformation systems (with strong compatibility). We prove our results in the abstract framework of well-structured transition systems and apply them to graph transformation systems, incorporating also the concept of adverse conditions.

Verification column

This quarter, we have an authoritative treatment of several basic verification problems for parallel programs running with shared memory under the topical total store ordering model. The article is also a testimony to the enduring relevance of the theory and practice of well-structured transition systems, which was recognised by the 2017 CAV Award.

Forward analysis for WSTS, part I: completions

AbstractWe define representations for downward-closed subsets of a rich family of well-quasi-orders, and more generally for closed subsets of an even richer family of Noetherian topological spaces. This includes the cases of finite words, of multisets, of finite trees, notably. Those representations are given as finite unions of ideals, or more generally of irreducible closed subsets. All the representations we explore are computable, in the sense that we exhibit algorithms that decide inclusion, and compute finite unions and finite intersections. The origin of this work lies in the need for computing finite representations of sets of successors of the downward closure of one state, or more generally of a downward-closed set of states, in a well-structured transition system, and this is where we start: we define adequate notions of completions of well-quasi-orders, and more generally, of Noetherian spaces. For verification purposes, we argue that the required completions must be ideal completions, or more generally sobrifications, that is, spaces of irreducible closed subsets.

Parameterized verification of coverability in infinite state broadcast networks

Parameterized verification of coverability in broadcast networks with finite state processes has been studied for different types of models and topologies. In this paper, we attempt to develop a theory of broadcast networks in which the processes can be well-structured transition systems. The resulting formalism is called well-structured broadcast networks. For various types of communication topologies, we prove the decidability of coverability in the static case, i.e., when the network topology is not allowed to change. We do this by showing that for these types of static communication topologies, the broadcast network itself is a well-structured transition system, hence proving the decidability of coverability in the broadcast network. We also give an algorithm to decide coverability of well-structured broadcast networks when reconfiguration of links between nodes is allowed. Finally, with minor modifications of this algorithm we prove decidability of coverability when the underlying process is a pushdown automaton.

The ideal view on Rackoff's coverability technique

Well-structured transition systems form a large class of infinite-state systems, for which safety verification is decidable thanks to a generic backward coverability algorithm. However, for several classes of systems, the generic upper bounds one can extract from the algorithm are far from optimal. In particular, in the case of vector addition systems (VAS) and several of their extensions, the known tight upper bounds were rather derived thanks to ad-hoc arguments based on Rackoff's small witness property.We show how to derive the same bounds directly on the computations of the VAS instantiation of the generic backward coverability algorithm. This relies on a dual view of the algorithm using ideal decompositions of downwards-closed sets, which exhibits a key structural invariant in the VAS case. This reasoning offers a uniform setting for all well-structured transition systems, including branching ones, and we further apply it to several VAS extensions, deriving optimal upper bounds.

Automata Column

In this issue, the automata column discusses a powerful decision procedure for infinite state systems, which I would call the Hilbert Method, because it uses theorems like Hilbert's Basis Theorem or the Nullstellensatz. The method - which reduces combinatorial objects like words or trees to algebraic objects like numbers and polynomials - has been used to solve important open problems like: Ehrenfeucht's Conjecture, the equivalence problem for HDT0L systems, or the equivalence problem for tree-to-string transducers. Because of its power, generality and simplicity, I think that the method should become a standard part of the toolkit of automata theory for working with infinite state systems, joining established methods like integer programming or well-structured transition systems.

Parameterized Verification of Coverability in Well-Structured Broadcast Networks

Parameterized verification of coverability in broadcast networks with finite state processes has been studied for different types of models and topologies. In this paper, we attempt to develop a theory of broadcast networks in which the processes can be well-structured transition systems. The resulting formalism is called well-structured broadcast networks. We give an algorithm to decide coverability of well-structured broadcast networks when reconfiguration of links between nodes is allowed. Further, for various types of communication topologies, we also prove the decidability of coverability in the static case as well. We do this by showing that for these types of static communication topologies, the broadcast network itself is a well-structured transition system, hence proving the decidability of coverability in the broadcast network.

Occam's Razor applied to the Petri net coverability problem

The verification of safety properties for concurrent systems often reduces to the coverability problem for Petri nets. This problem was shown to be ExpSpace-complete forty years ago. Driven by the concurrency revolution, it has regained a lot of interest over the last decade. In this paper, we propose a generic and simple approach to solve this problem. Our method is inspired from the recent approach of Blondin, Finkel, Haase and Haddad presented at TACAS in 2016. Basically, we combine forward invariant generation techniques for Petri nets with backward reachability for well-structured transition systems. An experimental evaluation demonstrates the efficiency of our approach.

Parameterized verification of monotone information systems

Abstract In this paper, we study the information system verification problem as a parameterized verification one. Informations systems are modeled as multi-parameterized systems in a formal language based on the Algebraic State-Transition Diagrams (ASTD) notation. Then, we use the Well Structured Transition Systems (WSTS) theory to solve the coverability problem for an unbounded ASTD state space. Moreover, we define a new framework to prove the effective pred-basis condition of WSTSs, i.e. the computability of a base of predecessors for every states.

Handling infinitely branching well-structured transition systems

Most decidability results concerning well-structured transition systems apply to the finitely branching variant. Yet some models (inserting automata, ω-Petri nets, …) are naturally infinitely branching. Here we develop tools to handle infinitely branching WSTS by exploiting the crucial property that in the (ideal) completion of a well-quasi-ordered set, downward-closed sets are finite unions of ideals. Then, using these tools, we derive decidability results and we delineate the undecidability frontier in the case of the termination, the maintainability and the coverability problems. Coverability and boundedness under new effectiveness conditions are shown decidable.

Инструмент для анализа поведения вполне структурированных систем переходов

Инструмент для анализа поведения вполне структурированных систем переходов

Petri Nets with Structured Data

This paper considers Structured Data Nets (StDN): a Petri net extension that describes open systems with data. The objective of this language is to serve as a formal basis for the analysis of systems that use data, accept inputs from their environment, and implement complex workflows. In StDNs, tok ens are structured documents. Each transition is attached to a query, guarded by patterns, (logical assertions on the contents of its preset) and transforms tokens. We define StDNs and their semantics. We then consider their formal properties: coverability of a marking, termination and soundness of transactions. Unrestricted StDNs are Turing complete, so coverability, termination and soundness are undecidable for StDNs. However, using an order on documents, and putting reasonable restrictions both on the expressiveness of patterns and queries and on the documents, we show that StDNs are well-structured transition systems, for which coverability, termination and soundness are decidable. We then show the expressive power of StDN on a case study, and compare StDNs and their decidable subclasses with other types of high-level nets and other formalisms adapted to data-centric approaches or to workflows design.

Self-Similarity Breeds Resilience

Self-similarity is the property of a system being similar to a part of itself. We posit that a special class of behaviourally self-similar systems exhibits a degree of resilience to adversarial behaviour. We formalise the notions of system, adversary and resilience in operational terms, based on transition systems and observations. While the general problem of proving systems to be behaviourally self-similar is undecidable, we show, by casting them in the framework of well-structured transition systems, that there is an interesting class of systems for which the problem is decidable. We illustrate our prescriptive framework for resilience with some small examples, e.g., systems robust to failures in a fail-stop model, and those avoiding side-channel attacks.

Forward analysis and model checking for trace bounded WSTS

We investigate a subclass of well-structured transition systems (WSTS), the trace bounded—in the sense of Ginsburg and Spanier (1964), [1]—complete deterministic ones, which we claim provide an adequate basis for the study of forward analyses as developed by Finkel and Goubault-Larrecq (2012), [2]. Indeed, we prove that, unlike other conditions considered previously for the termination of forward analysis, trace boundedness is decidable. Trace boundedness turns out to be a valuable restriction for WSTS verification, as we show that it further allows to decide all ω-regular properties on the set of infinite traces of the system.

Well-structured graph transformation systems

Graph transformation systems (GTSs) can be seen as well-structured transition systems (WSTSs) and via well-structuredness it is possible to obtain decidability results for certain classes of GTSs. We present a generic framework, parameterized over the well-quasi-order (wqo), in which several types of GTSs can be seen as (restricted) WSTSs. We instantiate this framework with three orders: the minor ordering, the subgraph ordering and the induced subgraph ordering. Furthermore we consider two case studies where we apply the theory to analyze a leader election protocol and a simple access rights management system with our tool Uncover.

Well Structured Transition Systems with History

We propose a formal model of concurrent systems in which the history of a computation is explicitly represented as a collection of events that provide a view of a sequence of configurations. In our model events generated by transitions become part of the system configurations leading to operational semantics with historical data. This model allows us to formalize what is usually done in symbolic verification algorithms. Indeed, search algorithms often use meta-information, e.g., names of fired transitions, selected processes, etc., to reconstruct (error) traces from symbolic state exploration. The other interesting point of the proposed model is related to a possible new application of the theory of well-structured transition systems (wsts). In our setting wsts theory can be applied to formally extend the class of properties that can be verified using coverability to take into consideration (ordered and unordered) historical data. This can be done by using different types of representation of collections of events and by combining them with wsts by using closure properties of well-quasi orderings.

Proof Spaces for Unbounded Parallelism

In this paper, we present a new approach to automatically verify multi-threaded programs which are executed by an unbounded number of threads running in parallel. The starting point for our work is the problem of how we can leverage existing automated verification technology for sequential programs (abstract interpretation, Craig interpolation, constraint solving, etc.) for multi-threaded programs. Suppose that we are given a correctness proof for a trace of a program (or for some other program fragment). We observe that the proof can always be decomposed into a finite set of Hoare triples, and we ask what can be proved from the finite set of Hoare triples using only simple combinatorial inference rules (without access to a theorem prover and without the possibility to infer genuinely new Hoare triples)? We introduce a proof system where one proves the correctness of a multi-threaded program by showing that for each trace of the program, there exists a correctness proof in the space of proofs that are derivable from a finite set of axioms using simple combinatorial inference rules. This proof system is complete with respect to the classical proof method of establishing an inductive invariant (which uses thread quantification and control predicates). Moreover, it is possible to algorithmically check whether a given set of axioms is sufficient to prove the correctness of a multi-threaded program, using ideas from well-structured transition systems.

Distraction intermaxillaire chirurgicalement assisté dans le syndrome d’apnées hypopnées obstructives du sommeil (SAHOS)

We apply language theory to compare the expressive power of infinite-state models that extend Petri nets with features like coloured tokens and/or whole place operations. Specifically, we consider extensions of Petri nets in which tokens carry pure names dynamically generated with special ν-transitions (ν-PN) and compare their expressiveness with transfer and reset nets with black indistinguishable tokens (Affine Well-Structured Nets), and nets in which tokens carry data taken from a linearly ordered domain (Data nets and CMRS). All these models are well-structured transition systems. In order to compare these models we consider the families of languages they recognize, using coverability as the accepting condition. With this criterion, we prove that ν-PNs are in between AWNs and Data Nets/CMRS, but equivalent to an extension of ν-PN with whole-place operations. These results extend the currently known classification of the expressive power of well-structured transition systems. Finally, we study several problems regarding (coverability) languages of AWN and ν-PN.

Ordinal theory for expressiveness of well-structured transition systems

We characterize the importance of resources (like counters, channels, or alphabets) when measuring the expressiveness of Well-Structured Transition Systems (WSTS). We establish, for usual classes of well partial orders, the equivalence between the existence of order reflections (non-monotonic order embeddings) and the simulations with respect to coverability languages. We show that the non-existence of order reflections can be proved by the computation of order types. This allows us to extend the current classification of WSTS, in particular solving some open problems, and to unify the existing proofs.