Programs that manipulate heap-allocated data structures present a formidable challenge for algorithmic verification. Recursive procedures (methods) in such software libraries are used for a large number of tasks ranging from simple traversals to complex structural transformations. Verification of such methods is undecidable in general. Hence, we present a programming language fragment with a syntax similar to that of C for which correctness can be algorithmically checked. For methods written in our fragment, and specifications in the form of tree automata, verification is efficient in most cases, as illustrated by our prototype tool. Our framework can be used to verify methods such as insertion and deletion of nodes in k-ary trees, binary search trees, linked lists, linked list reversal, and rotations in balanced trees, with respect to specifications such as acyclicity, sortedness, list-ness, tree-ness, and absence of null pointer dereferences.

Methods in object-oriented concurrent libraries hide internal synchronization details. However, information hiding may result in clients causing thread safety violations by invoking methods in an unsafe manner. Given such a library, we present a technique for inferring interface contracts that specify permissible concurrent method calls and patterns of aliasing among method arguments, such that the derived contracts guarantee deadlock free execution for the methods in the library. The contracts also help client developers by documenting required assumptions about the library methods. Alternatively, the contracts can be statically enforced in the client code to detect potential deadlocks in the client. Our technique combines static analysis with a symbolic encoding for tracking lock dependencies, allowing us to synthesize contracts using a SMT solver. Our prototype tool analyzes over a million lines of code for some widely-used Java libraries within an hour, thus demonstrating its scalability and efficiency. Furthermore, the contracts inferred by our approach have been able to pinpoint real deadlocks in clients, i.e. deadlocks that have been a part of bug-reports filed by users and developers of the client code.

Automatic techniques for software verification focus on obtaining witnesses of program failure. Such counterexamples often fail to localize the precise cause of an error and usually do not suggest a repair strategy. We present an efficient algorithm to automatically generate a repair for an incorrect sequential Boolean program where program correctness is specified using a pre-condition and a post-condition. Our approach draws on standard techniques from predicate calculus to obtain annotations for the program statements. These annotations are then used to generate a synthesis query for each program statement, which if successful, yields a repair. Furthermore, we show that if a repair exists for a given program under specified conditions, our technique is always able to find it.

State-space-partitioning-based approaches have been proposed in the literature to address the state-explosion problem in model checking. These approaches, whether sequential or distributed, perform a large amount of work in the form of interpartition (crossover) image computations, which can be expensive. A model-checking algorithm that aggregates these expensive crossover images by localizing computation to individual partitions is presented. It reduces the number of crossover images and drastically outperforms extant approaches in terms of crossover image computation cost as well as total model-checking time, often by two orders of magnitude.

Partitioned BDD-based algorithms have been proposed in the literature to solve the memory explosion problem in BDD-based verification. Such algorithms can be at times ineffective as they suffer from the problem of scheduling the relative order in which the partitions are processed. In this paper we present a novel multi-threaded reachability algorithm that avoids this scheduling problem while increasing the latent parallelism in partitioned state space traversal. We show that in most cases our method is significantly faster than both the standard reachability algorithm as well as the existing partitioned approaches. The gains are further magnified when our threaded implementation is evaluated in the context of a parallel framework.

Methods for mechanically synthesizing concurrent programs from temporal logic specifications obviate the need to manually construct a program and compose a proof of its correctness. A serious drawback of extant synthesis methods, however, is that they produce concurrent programs for models of computation that are often unrealistic. In particular, these methods assume completely fault-free operation, that is, the programs they produce are fault-intolerant. In this paper, we show how to mechanically synthesize fault-tolerant concurrent programs for various fault classes. We illustrate our method by synthesizing fault-tolerant solutions to the mutual exclusion and barrier synchronization problems.

The parameterized model checking problem (PMCP) is to decide whether a temporal property holds for a uniform family of systems, C||U/sup n/, comprised of a control process, C, and finitely, but arbitrarily, many copies of a user process, U, executing concurrently with interleaving semantics. We delineate the decidability/undecidability boundary of the PMCP for all possible systems that arise by letting processes coordinate using different subsets of the following communication primitives: conjunctive Boolean guards, disjunctive Boolean guards, pairwise rendezvous, asynchronous rendezvous and broadcast actions. Our focus is on the following linear time properties: (p1) LTL/spl bsol/X formulae over C; (p2) LTL formulae over C; (p3) regular properties specified as regular automata; and (p4) /spl omega/-regular automata. We also establish a hierarchy based on the relative expressive power of the primitives by showing that disjunctive guards and pairwise rendezvous are equally expressive, in that we can reduce the PMCP for regular and /spl omega/-regular properties for systems with disjunctive guards and pairwise rendezvous are equally expressive, in that we can reduce the PMCP for regular and /spl omega/-regular properties for systems with disjunctive guards to ones with pairwise rendezvous and vise versa, but that each of asynchronous rendezvous and broadcasts is strictly more expressive than pairwise rendezvous (and disjunctive guards). Moreover, for systems with conjunctive guards, we give a simple characterization of the decidability/undecidability boundary of the PMCP by showing that allowing stuttering sensitive properties bridges the gap between decidability (for p1) and undecidability (for p2). A broad framework for modeling snoopy cache protocols is also presented for which the PMCP for p3 is decidable and that can model all snoopy cache protocols given by Culler and Emerson (1988) thereby overcoming the undecidability results.

Methods for mechanically synthesizing concurrent programs for temporal logic specifications have been proposed by Emerson and Clarke and by Manna and Wolper. An important advantage of these synthesis methods is that they obviate the need to manually compose a program and manually construct a proof of its correctness. A serious drawback of these methods in practice, however, is that they produce concurrent programs for models of computation that are often unrealistic, involving highly centralized system architecture (Manna and Wolper), processes with global information about the system state (Emerson and Clarke), or reactive modules that can read all of their inputs in one atomic step (Anuchitanukul and Manna, and Pnueli and Rosner). Even simple synchronization protocols based on atomic read/write primitives such as Peterson's solution to the mutual exclusion problem have remained outside the scope of practical mechanical synthesis methods. In this paper, we show how to mechanically synthesize in more realistic computational models solutions to synchronization problems. We illustrate the method by synthesizing Peterson's solution to the mutual exclusion problem.

We provide a general method for ameliorating state explosion via symmetry reduction in certain asymmetric systems, such as systems with many similar, but not identical, processes. The method applies to systems whose structures (i.e., state transition graphs) have more state symmetries than arc symmetries. We introduce a new notion of "virtual symmetry" that strictly subsumes earlier notions of "rough symmetry" and "near symmetry" (Emerson and Trefler, 1999). Virtual symmetry is the most general condition under which the structure of a system is naturally bisimilar to its quotient by a group of state symmetries. We give several example systems exhibiting virtual symmetry that are not amenable to symmetry reduction by earlier techniques: a one-lane bridge system, where the direction with priority for crossing changes dynamically; an abstract system with asymmetric communication network; and a system with asymmetric resource sharing motivated from the drinking philosophers problem. These examples show that virtual symmetry reduction applies to a significantly broader class of asymmetric systems than could be handled before.

The article presents the SMC system. SMC can be used for checking safety and liveness properties of concurrent programs under different fairness assumptions. It is based on explicit state enumeration. It combats the state explosion by exploiting symmetries of the input concurrent program, usually present in the form of identical processes, in two different ways. Firstly, it reduces the number of explored states by identifying those states that are equivalent under the symmetries of the system; this is called process symmetry . Secondly, it reduces the number of edges explored from each state, in0 the reduced state graph, by exploiting the symmetry of a single state; this is called state symmetry . SMC works in an on-the-fly manner; it constructs the reduced state graph as and when it is needed. This method facilitates early termination, speeds up model checking, and reduces memory requirements. We employed SMC to check the correctness of, among other standard examples, the Link Layer part of the IEEE Standard 1394 “Firewire” high-speed serial bus protocol. SMC found deadlocks in the protocol. SMC was also to check certain liveness properties. A report on the case study is included in the article.

We define Parameterized Real-Time Computation Tree Logic (PRTCTL), which allows quantitative temporal specifications to be parameterized over the natural numbers. Parameterized quantitative specifications are quantitative specifications in which concrete timing information has been abstracted away. Such abstraction allows designers to specify quantitative restrictions on the temporal ordering of events without having to use specific timing information from the model. A model checking algorithm for the logic is given which is polynomial for any fixed number of parameters. A subclass of formulae are identified for which the model checking problem is linear in the length of the formula and size of the structure. PRTCTL is generalised to allow quantitative reasoning about the number of occurrences of atomic events.

The complexity of testing nonemptiness of finite state automata on infinite trees is investigated. It is shown that for tree automata with the pairs (or complemented pairs) acceptance condition having m states and n pairs, nonemptiness can be tested in deterministic time (mn) O (n) ; however, it is shown that the problem is in general NP-complete (or co-NP-complete, respectively). The new nonemptiness algorithm yields exponentially improved, essentially tight upper bounds for numerous important modal logics of programs, interpreted with the usual semantics over structures generated by binary relations. For example, it follows that satisfiability for the full branching time logic CTL * can be tested in deterministic double exponential time. Another consequence is that satisfiability for propositional dynamic logic (PDL) with a repetition construct (PDL-delta) and for the propositional Mu-calculus ($L\mu$) can be tested in deterministic single exponential time.

We demonstrate that many known algorithms for model checking infinite-state systems can be derived uniformly from a reachability procedure that generates a "covering graph", a generalization of the Karp-Miller graph for Petri Nets. Each node of the covering graph has an associated non-empty set of reachable states, which makes it possible to model check safety properties of the system on the covering graph. For systems with a well-quasi-ordered simulation relation, each infinite fair computation has a finite witness, which may be detected using the covering graph and combinatorial properties of the specific infinite state system. These results explain many known decidability results in a simple, uniform manner. This is a strong indication that the covering graph construction is appropriate for the analysis of infinite state systems. We also consider the new application domain of parameterized broadcast protocols, and indicate how to apply the construction in this domain. This application is illustrated on an invalidation-based cache coherency protocol, for which many safety properties can be proved fully automatically for an arbitrary number of processes.

Methods for mechanically synthesizing concurrent programs from temporal logic specificationsobviate the need to manually construct a program and compose a proof of its correctness. A seriousdrawback of extant synthesis methods, however, is that they produce concurrent programs formodels of computation that are often unrealistic. In particular, these methods assume completelyfault-free operation, that is, the programs they produce are fault-intolerant. In this paper, we showhow to mechanically synthesize fault-tolerant concurrent programs for various fault classes. Weillustrate our method by synthesizing fault-tolerant solutions to the mutual exclusion and barriersynchronization problems.Categories and Subject Descriptors: C.2.4 [

Methods for synthesizing concurrent programs from temporal logic specifications based on the use of a decision procedure for testing temporal satisfiability have been proposed by Emerson and Clarke and by Manna and Wolper. An important advantage of these synthesis methods is that they obviate the need to manually compose a program and manually construct a proof of its correctness. One only has to formulate a precise problem specification; the synthesis method then mechanically constructs a correct solution. A serious drawback of these methods in practice, however, is that they suffer from the state explosion problem. To synthesize a concurrent system consisting of K sequential processes, each having N states in its local transition diagram, requires construction of the global product-machine having about N K global states in general. This exponential growth in K makes it infeasible to synthesize systems composed of more than 2 or 3 processes. In this article, we show how to synthesize concurrent systems consisting of many (i.e., a finite but arbitrarily large number K of) similar sequential processes. Our approach avoids construction of the global product-machine for K processes; instead, it constructs a two-process product-machine for a single pair of generic sequential processes. The method is uniform in K , providing a simple template that can be instantiated for each process to yield a solution for any fixed K . The method is also illustrated on synchronization problems from the literature.

"Verification" of large multiprocessor designs currently heavily on simulation. Formal techniques such as model checking are typically only applied to small parts of the system, due to issues of computational and notational complexity. With these two facts in mind the authors have designed a platform which aims to help bridge the gap between formal verification and simulation. They present a temporal logic specification language which includes constructs for specifying system behavior at a high level of abstraction, and discuss its use in simulation and model checking.

One useful technique for combating the state explosion problem is to exploit symmetry when performing temporal logic model checking. In previous work it is shown how, using some basic notions of group theory, symmetry may be exploited for the full range of correctness properties expressible in the very expressive temporal logic CTL*. Surprisingly, while fairness properties are readily expressible in CTL*, these methods are not powerful enough to admit any amelioration of state explosion, when fairness assumptions are involved. We show that it is nonetheless possible to handle fairness efficiently by trading some group theory for automata theory. Our automata-theoretic approach depends on detecting fair paths subtly encoded in a quotient structure whose arcs are annotated with permutations, by using a threaded structure that reflects coordinate shifts caused by the permutations.

Methods for mechanically synthesizing concurrent programs from temporal logic specifications have been proposed (cf.[EC82, MW84, PR$9, PR89b, AM94]).An important advantage of these synthesis methods is that they obviate the need to manually construct a program and compose a proof of its correctness.A serious drawback of these methods in practice, however, is that they produce concurrent programs for models of computation that are often unrealistic, involving highly centralized system architecture (cf.[MW84] ) or processes with global information about the system state (cf.[EC82]).Even simple synchronization protocols based on atomic read / atomic write primitives such as Peterson's solution to the mutual exclusion problem have remained outside the scope of practical mechanical synthesis methods.In this paper, we show how to mechanically synthesize in more realistic computational models solutions to synchronization problems.We illustrate the method by synthesizing Peterson's solution to the mutual exclusion problem.

The ring is a useful means of structuring concurrent processes. Processes communicate by passing a token in a fixed direction; the process that possesses the token is allowed to make certain moves. Usually, correctness properties are expected to hold irrespective of the size of the ring. We show that the problem of checking many useful correctness properties for rings of all sizes can be reduced to checking them on a ring of small size. The results do not depend on the processes being finite state. We illustrate our results on examples.

We describe a purely declarative method for introducing modularity into forward-chaining, rule-based languages and its embodiment in the Venus rule language. The method is enforced by the syntax of the language and includes the ability to parameterize the rule groups. Drawing from two of three Venus applications developed to date, we illustrate how this form of modularity contributes directly to the resolution of certain software engineering problems associated with rule languages.>

In this article, we propose a language, Asynchronous Propositional Temporal Logic (APTL), for the specification and verification of distributed hard real-time sytems. APTL extends the logic TPTL by dealing explicitly with multiple local clocks. We propose a distributed-system model which permits definition of inequalities asserting the temporal precedence of local clock readings. We show the expressiveness of APTL through two nontrivial examples. Our logic can be used to specify and reason about such important properties as bounded clock rate drifting. We then give a 2 2 0(n) tableau-based decision procedure for determining APTL satisfiability, where n is the size (number of bits) of the input formula.

Article Free Access Share on Formal specification of asynchronous distributed real-time systems by APTL Authors: Farn Wang View Profile , Al Mok View Profile , E. Allen Emerson View Profile Authors Info & Claims ICSE '92: Proceedings of the 14th international conference on Software engineeringJune 1992 Pages 188–198https://doi.org/10.1145/143062.143113Published:01 June 1992Publication History 4citation137DownloadsMetricsTotal Citations4Total Downloads137Last 12 Months5Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

There has been much interest in decision procedures for testing satisfiability in various systems of temporal logic. This is due to the potential applications of these decision procedures to reasoning about the correctness of concurrent programs. In this paper, we exhibit a temporal logic that is both useful in applications to program reasoning and is efficiently decidable in quadratic time. A surprising corollary of our results is that the fragment of CTL (Computation Tree Logic) used by Emerson & Clarke [11] to synthesize concurrent programs from temporal specifications is actually decidable in polynomial time. Our results demonstrate that many useful correctness properties can be expressed with a rather restricted syntax, and provide insight into the relation between the syntactic complexity of temporal logics and the complexity of testing satisfiability.

It is shown that the propositional mu-calculus is equivalent in expressive power to finite automata on infinite trees. Since complementation is trivial in the mu-calculus, the equivalence provides a radically simplified, alternative proof of M.O. Rabin's (1989) complementation lemma for tree automata, which is the heart of one of the deepest decidability results. It is also shown how mu-calculus can be used to establish determinacy of infinite games used in earlier proofs of complementation lemma, and certain games used in the theory of online algorithms.>

An analysis is made of the contribution of the temporal operators alone to the complexity of deciding temporal logics by suppressing the role the usual Boolean connectives play in determining lower bounds on the complexity of their decision procedures. Several temporal logics are exhibited which can state many properties useful in describing temporal systems and which restrict combinations of temporal and Boolean operators so as to be decidable in low deterministic polynomial time. It is also shown that relaxing any of the constraints placed on the syntax of these logics results in intractability, thereby demonstrating that there is a fine line separating tractably decidable sets of temporal formulas from intractable ones.>

The authors give a construction to determine and complement simultaneously a Buchi automaton in infinite strings, with an exponential blowup in states and a linear blowup in the number of pairs. An exponential lower bound is already known. The previous best construction was double exponential. The present result permits exponentially improved essentially optimal decision procedures for various modal logics of programs. It also gives exponentially improved conversions between various kinds of omega automata.>

Methods for synthesizing concurrent programs from Temporal Logic specifications based on the use of a decision procedure for testing temporal satisfiability have been proposed by Emerson & Clarke [EC82] and Manna & Wolper [MW84]. An important advantage of these synthesis methods is that they obviate the need to manually compose a program and manually construct a proof of its correctness. One only has to formulate a precise problem specification; the synthesis method then mechanically constructs a correct solution. A serious drawback of these methods in practice, however, is that they suffer from the state explosion problem. To synthesize a concurrent system consisting of K sequential processes, each having N states in its local transition diagram, requires construction of the global product-machine having at least NK global states in general. This exponential growth in K makes it infeasible to synthesize systems composed of more than 2 or 3 processes. In this paper, we show how to synthesize concurrent systems consisting of many (i.e., a finite but arbitrarily large number K of) similar sequential processes. Our approach avoids construction of the global product-machine for K processes; instead, it constructs a two process product-machine for a single pair of generic sequential processes. The method is uniform in K, providing a simple template that can be instantiated for each process to yield a solution for any fixed K. The method is also illustrated on synchronization problems from the literature.

There has been much interest in decision procedures for testing satisfiability (or validity) of formulae in various systems of Temporal Logic. This is due to the potential applications of such decision procedures to mechanical reasoning about correctness of concurrent programs. We show that there exist Temporal Logics that are (i) decidable in polynomial time, and (ii) still useful in applications. One surprising corollary of our results is that the fragment of CTL (Computation Tree Logic) actually used by Emerson & Clarke [EC82] to synthesize concurrent programs from temporal specifications is decidable in polynomial time. Another is that the verification of many correctness properties of concurrent programs (such as in Owicki & Lamport [OL82]) can be efficiently automated. This demonstrates that many useful correctness properties can be expressed with a rather restricted syntax. Finally, our results provide insight into the relation between the structural (i.e., syntactic) complexity of temporal logics and the complexity of their decision problems.

The computational complexity of testing nonemptiness of finite-state automata on infinite trees is investigated. It is shown that for tree automata with m states and n pairs nonemptiness can be tested in time O((mn)/sup 3n/), even though the problem is in general NP-complete. The nonemptiness algorithm is used to obtain exponentially improved, essentially tight upper bounds for numerous important modal logics of programs, interpreted with the usual semantics over structures generated by binary relations. For example, it is shown that satisfiability for the full branching time logic CTL* can be tested in deterministic double exponential time. It also follows that satisfiability for propositional dynamic logic with a repetition construct (PDL-delta) and for the propositional mu-calculus (L mu ) can be tested in deterministic single exponential time.>

The differences between and appropriateness of branching versus linear time temporal logic for reasoning about concurrent programs are studied. These issues have been previously considered by Lamport. To facilitate a careful examination of these issues, a language, CTL * , in which a universal or existential path quantifier can prefix an arbitrary linear time assertion, is defined. The expressive power of a number of sublanguages is then compared. CTL* is also related to the logics MPL of Abrahamson and PL of Harel, Kozen, and Parikh. The paper concludes with a comparison of the utility of branching and linear time temporal logics.

We give an efficient procedure for verifying that a finite-state concurrent system meets a specification expressed in a (propositional, branching-time) temporal logic. Our algorithm has complexity linear in both the size of the specification and the size of the global state graph for the concurrent system. We also show how this approach can be adapted to handle fairness. We argue that our technique can provide a practical alternative to manual proof construction or use of a mechanical theorem prover for verifying many finite-state concurrent systems. Experimental results show that state machines with several hundred states can be checked in a matter of seconds.

Article Modalities for model checking (extended abstract): branching time strikes back Share on Authors: E. Allen Emerson Department of Computer Sciences, University of Texas at Austin, Austin, Texas Department of Computer Sciences, University of Texas at Austin, Austin, TexasView Profile , Chin-Laung Lei Department of Computer Sciences, University of Texas at Austin, Austin, Texas Department of Computer Sciences, University of Texas at Austin, Austin, TexasView Profile Authors Info & Claims POPL '85: Proceedings of the 12th ACM SIGACT-SIGPLAN symposium on Principles of programming languagesJanuary 1985 Pages 84–96https://doi.org/10.1145/318593.318620Online:01 January 1985Publication History 110citation612DownloadsMetricsTotal Citations110Total Downloads612Last 12 Months13Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

In this paper we study the full branching time logic (CTL*) in which a path quantifier, either A (“for all paths”) or E (ldquo;for some path”), prefixes an assertion composed of arbitrary combinations of the usual linear time operators F (“sometime”), G (“always”), X (“nexttime”), and U (“until”). We show that the problem of determining if a CTL* formula is satisfiable in structure generated by a binary relation is decidable in triple exponential time. The decision procedure exploits the special structure of the finite state ω-automata for linear temporal formulae which allows them to be determinized with only a single exponential blowup in size. We also compare the expressive power of tree automata with CTL* augmented by quantified auxillary propositions.

We give an efficient procedure for verifying that a finite state concurrent system meets a specification expressed in a (propositional) branching-time temporal logic. Our algorithm has complexity linear in both the size of the specification and the size of the global transition graph for the concurrent system. We also show how the logic and our algorithm can be modified to handle fairness. We argue that this technique can provide a practical alternative to manual proof construction or use of a mechanical theorem prover for verifying many finite state concurrent systems.

Temporal logic ([PR57], [PR67]) provides a formalism for describing the occurrence of events in time which is suitable for reasoning about concurrent programs (cf. [PN77]). In defining temporal logic, there are two possible views regarding the underlying nature of time. One is that time is linear: at each moment there is only one possible future. The other is that time has a branching, tree-like nature: at each moment, time may split into alternate courses representing different possible futures. Depending upon which view is chosen, we classify (cf. [RU71]) a system of temporal logic as either a linear time logic in which the semantics of the time structure is linear, or a system of branching time logic based on the semantics corresponding to a branching time structure. The modalities of a temporal logic system usually reflect the semantics regarding the nature of time. Thus,in a logic of linear time, temporal operators are provided for describing events along a single time path (cf. [GPSS80]). In contract, in a logic of branching time the operators reflect the branching nature of time by allowing quantification over possible futures cf. [AB80],[EC80]).

In this paper we consider the Computation Tree Logic (CTL) proposed in [CE] which extends the Unified Branching Time Logic (UB) of [BMP] by adding an until operator. We establish that CTL has the small property by showing that any satisfiable CTL formulae is satisfiable in a small finite model obtained from a small “pseudo-model” resulting from the Fischer Ladner quotient construction. We then give an exponential time algorithm for deciding satisfiability in CTL, and extend the axiomatization of UB given in [BMP] to a complete axiomatization for CTL. Lastly, we study the relative expressive power of a family of temporal logics obtained by extending or restricting the syntax of UB and CTL.