Golok: Push-button Verification of Parameterized Systems

ion techniques include counter abstraction [German and Sistla 1992; Pnueli et al. 2002] and environment abstraction [Clarke et al. 2006; 2008]. The idea behind counter abstraction is to abstract process identities, where every abstract state contains an abstract counter denoting the number of processes in the state. Environment abstraction is the closest to our work. It follows a similar approach as counter abstraction; however, the counting is done for the number of processes satisfying a given predicate. An abstract environment is generated for a reference process to show all possible relations this process can have with its environment; which is closely related to our technique where we compute the maximal behavior that a process can induce in an arbitrary environment. The advantage of these abstraction-based techniques is that they can verify a class of ACM Journal Name, Vol. V, No. N, March 2010. Golok: Push-button Verification of Parameterized Systems · 29 parameterized systems that we do not currently cover: systems whose individual processes are not necessarily finite-state such as the Lamport’s Bakery algorithm [Lamport 1974] and Szymanski’s algorithm [Szymanski 1988]; however, typically these techniques either require human guidance for obtaining the appropriate abstraction or are applicable to a certain restricted class of systems and/or properties (e.g., universal path properties). 8.2 Smart representation-based Techniques Another class of techniques that rely on smart representation mechanism are techniques based on regular language [Bouajjani et al. 2000; Abdulla et al. 2002; Abdulla et al. 2007; Fisman et al. 2008] or graph-based [Saksena et al. 2008; Baldan et al. 2005; Baldan et al. 2008; Llorens and Oliver 2004] representations of the state-space of the parameterized system. These approaches are typically applicable for the verification of safety/reachabil- ity properties of parameterized systems. Recently, petri-net based representation has been proposed [Bouajjani et al. 2007] where tokens in the petri-net are used to denote the pa- rameter of the system and a new logic, colored markings logic (CML), is developed to reason about such petri-nets. The work provides a generic framework for representing pa- rameterized systems and identifies a fragment of CML for which the satisfiability problem is decidable. Similar to the environment abstraction, some these techniques allow verification of sys- tems with infinite-state processes. On the other hand, most of these techniques do not provide algorithmic techniques and focus only on one or two classes of systems while we provide a algorithmic (but incomplete) technique that works for several classes. We also present an implementation of our technique to prove its applicability. 8.3 Induction-based Techniques Techniques based on induction use network invariants to reduce the problem of parameter- ized system verification to a finite state model checking problem [Wolper and Lovinfosse 1990; Arons et al. 2001; Clarke et al. 1995]. The idea behind these techniques is to find a network invariant I where the invariant is preserved by all computation steps of the system. Therefore, if I satisfies the desired property specification φ then the parameterized system also satisfies φ. The invariant generation process in these techniques usually requires man- ual guidance, while in our technique the cut-off generation is fully automatic. Pnueli et al. [Pnueli et al. 2001] present a technique where invariants are computed automatically once the appropriate abstraction relation is provided. The advantadge of this technique is that it covers the bounded-data parameterized systems that we currently do not model; however, the technique works for systems with only one type of parameterized processes and it is not clear how it may be generated to multi-parameterized systems. 8.4 Cut-off Computation Techniques Closest to our technique is the class of solutions that focus on computing a cut-off of the system parameter [Emerson and Namjoshi 1995; Emerson and Kahlon 2003; Emerson et al. 2006; Emerson and Namjoshi 1996; Emerson and Kahlon 2002; Ball et al. 2001; Yang and Li 2010; Ip and Dill 1996; Bingham and Hu 2005; Siirtola 2010]. This class of solutions aims to reduce the parameterized system verification problem to an equivalent finite-state one, is based on finding an appropriate cut-off k of the parameter of the system. The objective is to establish that a property is satisfied by the system with k processes if and only if it is satisfied by any number (≥ k) processes. Emerson and Namjoshi [EmerACM Journal Name, Vol. V, No. N, March 2010. 30 · Hanna, Samuelson, Basu and Rajan son and Namjoshi 1995] provide such cut-off values for different types of properties of parameterized systems with ring topology. In contrast to the above techniques, our approach is fully automatic, does not depend on a specific representation mechanism of the system and/or property and is independent of the communication topology of the processes in the system. We present a sound but incomplete method which takes as input the description of the parameterized system in terms of standard input/output automata and establishes the cut-off of the parameter value. While Emerson and Namjoshi [Emerson and Namjoshi 1995] establish for the first time the cut-off bound for any parameterized system with ring topology given a specific type of property; we show that by considering the parameterized system being verified in the computation of the cut-off, a tighter bound of the cut-off can be obtained. For instance, using Emerson and Namjoshi’s approach [Emerson and Namjoshi 1995], to verify the property that in a parameterized system with ring topology two processes cannot enter the critical section at the same, the cut-off size is 4; while the cut-off value identified using our approach for a specific parameterized system with ring topology (token ring protocol) is only 2. In short, while Emerson and Namjoshi [Emerson and Namjoshi 1995] focus on obtaining a generic cut-off for parameterized systems with a specific topology, the central theme of our technique is to develop a generic approach that can be applied to parameterized systems independent of the communication topology. 9. CONCLUSION AND FUTURE WORK Verification of correctness properties for parameterized systems is an important prob- lem [German and Sistla 1992; Pnueli et al. 2002; Clarke et al. 2006; 2008; Emerson and Namjoshi 1995; Emerson and Kahlon 2003; Emerson et al. 2006]. Considering that this problem is undecidable in general [Apt and Kozen 1986], techniques and heuristics for solving it for a subset of scenarios is an equally important problem. To that end, computing the cut-off of the system parameter is shown to be an effective technique for solving the parameterized verification problem [Emerson and Namjoshi 1995; Emerson and Kahlon 2003; Emerson et al. 2006]. In contrast to the existing techniques, our approach, based on behavioral-automata com- position, can be applied to any parameterized systems independent of the communication topology. It provides a fully automatic sound but incomplete method for generating system cut-off for a parameterized system, where there exists more than one process type whose processes are unbounded and where processes can communicate via both single-cast and broadcast. Furthermore, effectively utilizing system descriptions allows us to obtain a system-specific cut-off, which in 14 out of 15 cases were found to be lower than previ- ously discovered bounds. A system cut-off, to a large extent, dictates the state space that needs to be explored by a formal verification technique. The systematic approach of find- ing this cut-off that our approach provides is thus an important and foundational advance towards improved scalability of formal verification techniques. We also implemented our technique in a tool, Golok, to show the applicability of our technique. Future work includes extending the theoretical and practical treatment of behavioral- automata composition to explore more expressive representation of protocols that can cap- ture parameterized systems with infinite-domain data. It would also be sensible to develop techniques to extract behavioral automata from common programming languages such that Golok can be applied to large real-world parameterized software systems. ACM Journal Name, Vol. V, No. N, March 2010. Golok: Push-button Verification of Parameterized Systems · 31