Abstract Interpretation of Reactive Systems

Interpretation of Reactive Systems DENNIS DAMS and ROB GERTH Eindhoven University of Technology and ORNA GRUMBERG Technion, Haifa The advent of ever more complex reactive systems in increasingly critical areas calls for the development of automated veri cation techniques. Model checking is one such technique, which has proven quite successful. However, the state-explosion problem remains a major stumbling block. Recent experience indicates that solutions are to be found in the application of techniques for property-preserving abstraction and successive approximation of models. Most such applications have so far been based solely on the property-preserving characteristics of simulation relations. A major drawback of all these results is that they do not o er a satisfactory formalisation of the notion of precision of abstractions. The theory of Abstract Interpretation o ers a framework for the de nition and justi cation of property-preservingabstractions. Furthermore, it provides a method for the e ective computation of abstract models directly from the text of a program, thereby avoiding the need for intermediate storage of a full-blown model. Finally, it formalises the notion of optimality, while allowing to trade precision for speed by computing sub-optimal approximations. For a long time, applications of Abstract Interpretation have mainly focussed on the analysis of universal safety properties, i.e. properties that hold in all states along every possible execution path. In this paper, we extend Abstract Interpretation to the analysis of both existential and universal reactive properties, as expressible in the modal -calculus. It is shown how abstract models may be constructed by symbolic execution of programs. A notion of approximation between abstract models is de ned while conditions are given under which optimal models can be constructed. Examples are given to illustrate this. We indicate conditions under which also falsehood of formulae is preserved. Finally, we compare our approach to those based on simulation relations. Categories and Subject Descriptors: F.3.1 [Logics and Meanings of Programs]: Specifying and Verifying and Reasoning about Programs|Mechanical veri cation; Logics of programs; D.2.4 [Software Engineering]: Program Veri cation|Validation General Terms: Reliability, Theory, Veri cation Additional Key Words and Phrases: Abstract interpretation, formal methods, model checking, mu-calculus, reactive systems Correspondence address: D. Dams, Dept. of Math. and Computing Science, Eindhoven University of Technology, P.O. Box 513, 5600 MB Eindhoven, The Netherlands. wsindd@win.tue.nl Permission to make digital/hard copy of all or part of this material without fee is granted provided that the copies are not made or distributed for pro t or commercial advantage, the ACM copyright/server notice, the title of the publication, and its date appear, and notice is given that copying is by permission of the Association for Computing Machinery, Inc. (ACM). To copy otherwise, to republish, to post on servers, or to redistribute to lists requires prior speci c permission and/or a fee. ACM Transactions on Programming Languages and Systems, Vol. ?, No. ?, ?? 19??, Pages 111{149. 112 Dennis Dams et al. 1. INTRODUCTION In the model-checking approach [Queille and Sifakis 1982; Clarke et al. 1986; Vardi and Wolper 1986; Kurshan 1994; Lichtenstein and Pnueli 1985] to program veri cation, a model of the program is constructed over which formulae are checked for satisfaction. The model re ects the possible behaviours of the program, while the formulae express certain required properties of such behaviours. Obviously, the size of the model is a limiting factor to the feasibility of the model-checking approach. In the worst case, it doubles with every extra bit of memory that the program may access. This problem is referred to as the state-explosion problem. One solution to it is the application of abstraction techniques, which aim to abstract the model to a smaller one, in such a way that if some property holds for the abstracted model, it also holds for the original model. Such abstraction techniques are formalised in the framework of Abstract Interpretation [Cousot and Cousot 1977], which was originally conceived as a unifying theory of compile-time (dataow) analyses. For a long time, applications of Abstract Interpretation have been focussed on the analysis of universal safety properties, that hold in all states (safety) along all possible executions (universality) of the program.1 With the advent of reactive systems, interest has broadened to a larger class of properties. Reactive systems are systems whose main role is to maintain an ongoing interaction with the environment, rather than to produce some nal result on termination. Usually, such systems consist of several concurrent processes, and display a non-deterministic behaviour. Typical examples are ight reservation systems, industrial plant controllers, embedded systems and operating systems. In the presence of non-determinism, one may be interested to know whether some property holds along some possible execution path. Such properties will be called existential. Besides safety, another kind of property that is often considered is liveness, meaning that something should hold eventually (given an execution). Thus, we have classi ed properties into four kinds by the criteria universal/existential and safety/liveness. A typical combination of universal safety and existential liveness properties is \along every possible execution path, in every state there is a possible continuation that will eventually reach a reset state". The semantic models and abstraction techniques used in the analysis of universal safety properties cannot be used for properties that involve aspects of existentiality and eventuality. The reason is that these techniques abstract away from information about the choices that a program encounters during execution. The analysis of existentiality and eventuality properties of behaviours, however, requires models that, in addition to information about single states, also provide the transitions between states. For this reason, in model checking reactive systems, transition systems are used to model the behaviour of programs. Being directed graphs over program states, such transition systems give detailed information about program executions, including the possible choices in every state. Our aim is to nd notions of abstraction of such transition systems that preserve certain combined forms of 1The notions of universality and safety of a property are not always distinguished as explicitly as we do in this paper. What we call \universal safety" is often just termed \safety" or \invariance" elsewhere. ACM Transactions on Programming Languages and Systems, Vol. ?, No. ?, ?? 19??. Abstract Interpretation of Reactive Systems 113 universal/existential safety/liveness properties. This means that in order to know that such a property holds in the original system, it su ces to know that it holds in the abstracted system. The properties may be formalised by expressing them in a logic whose formulae can be interpreted over transition systems. One such logic is L , the modal -calculus [Kozen 1983]. Besides a basic set of propositions stating local properties about states, and the usual boolean operations, it contains modalities that express that something holds in some next state or in all next states2. Furthermore, xpoint operators allow to combine such next-state properties into formulae expressing existential and universal properties about execution paths. Although properties specied in the -calculus are often less comprehensible than when expressed in temporal logics like CTL (computation tree logic, see Emerson and Halpern [1986]), L is preferable for our purposes, for the following reasons. Firstly, the basic temporal modalities correspond directly to two types of abstract transition relations to be de ned, which improves understanding and facilitates proofs. Furthermore, L allows a clean identi cation of universal and existential properties | see Section 2.2 where this point is discussed. Finally, L 's expressivity exceeds that of many other temporal logics, including CTL [Dam 1994]. Hence, the results of this paper immediately transfer to those logics as well. Together with the fact that the main focus of this paper is on preservation results, and not on the practice of specifying in L , these reasons should justify our choice for the -calculus. The structure of this article is as follows. The next section introduces the formal machinery to be used. In Section 3, a notion of abstract transition system is developed that preserves properties from L . A canonical abstraction is chosen so as to satisfy the maximum number of L properties. This choice is then justi ed in Section 4, where an approximation order between such systems is de ned. This approximation order is shown to coincide with the L -property ordering, and the canonical abstraction of Section 3 turns out to be optimal, i.e. it is the least element with regard to this ordering which is still safe. Section 5 shows how abstract transition systems may be computed directly from a program text by \lifting" the operations of a programming language to a domain of data descriptions. Conditions are given under which the constructed models are optimal. Furthermore, it is shown that sub-optimal models are constructed when computing approximations to the lifted operations. An elaborate example is presented in Section 6. Section 7 brie y indicates the consequences of insisting on strong preservation, meaning that not only truth, but also falsehood of formulae is preserved. Section 8 compares ours to related work, in particular to simulation-based approaches, and Section 9 concludes. On rst reading, it may be helpful to skip the more technical results of Subsections 4.1, 5.1, 5.2 and 5.3, to get to the exam