Abstract First-Order Linear Temporal Logic (FOLTL) is particularly convenient to specify distributed systems, in particular because of the unbounded aspect of their state space. We have recently exhibited novel decidable fragments of FOLTL which pave the way for tractable verification. However, these fragments are not expressive enough for realistic specifications. In this paper, we propose three transformations to translate a typical FOLTL specification into two of its decidable fragments. All three transformations are proved sound (the associated propositions are proved in Coq) and have a high degree of automation. To put these techniques into practice, we propose a specification language relying on FOLTL, as well as a prototype which performs the verification, relying on existing model checkers. This approach allows us to successfully verify safety and liveness properties for various specifications of distributed systems from the literature.

First-Order Linear Temporal Logic (FOLTL) is well-suited to specify infinite-state systems. However, FOLTL satisfiability is not even semi-decidable, thus preventing automated verification. To address this, a possible track is to constrain specifications to a decidable fragment of FOLTL, but known fragments are too restricted to be usable in practice. In this paper, we exhibit various fragments of increasing scope that provide a pertinent basis for abstract specification of infinite-state systems. We show that these fragments enjoy the Bounded Domain Property (any satisfiable FOLTL formula has a model with a finite, bounded FO domain), which provides a basis for complete, automated verification by reduction to LTL satisfiability. Finally, we present a simple case study illustrating the applicability and limitations of our results.

Chord is a protocol that provides a scalable distributed hash table over an underlying peer-to-peer network. Since it combines data structures, asynchronous communications, concurrency, and fault tolerance, it features rich structural and temporal properties that make it an interesting target for formal specification and verification. Previous work has mainly focused on automatic proofs of safety properties or manual proofs of the full correctness of the protocol (a liveness property). In this paper, we report on analyzing automatically the correctness of Chord with the Electrum language (developed in former work) on small instance of networks. In particular, we were able to find various corner cases in previous work and showed that the protocol was not correct as described there. We fixed all these issues and provided a version of protocol for which we were not able to find any counterexample using our method.

This paper presents the Electrum Analyzer, a free-software tool to validate and perform model checking of Electrum specifications. Electrum is an extension of Alloy that enriches its relational logic with LTL operators, thus simplifying the specification of dynamic systems. The Analyzer supports both automatic bounded model checking, with an encoding into SAT, and unbounded model checking, with an encoding into SMV. Instance, or counter-example, traces are presented back to the user in a unified visualizer. Features to speed up model checking are offered, including a decomposed parallel solving strategy and the extraction of symbolic bounds.

Model-checking is increasingly popular in the early phases of the software development process. To establish the correctness of a software design one must usually verify both structural and behavioral (or temporal) properties. Unfortunately, most specification languages, and accompanying model-checkers, excel only in analyzing either one or the other kind. This limits their ability to verify dynamic systems with rich configurations: systems whose state space is characterized by rich structural properties, but whose evolution is also expected to satisfy certain temporal properties.

In this paper we study the mode concept in asynchronous systems. First, we propose an abstract TLA+ specification. Then, we discuss how the mode concepts proposed by the two architecture languages: Giotto and AADL could be related to this abstraction.

A common way to show the termination of the union of two abstract reduction systems, provided both systems terminate, is to prove that they enjoy a specific property (some sort of ‘commutation’ for instance). This specific property is actually used to show that, for the union not to terminate, one of the systems must itself be non-terminating, which leads to a contradiction. Unfortunately, the property may be impossible to prove because some of the objects that are reduced do not enjoy an adequate form. Hence the purpose of this paper is threefold: – First, it introduces an operator enabling us to insert a reduction step on such an object, and therefore to change its shape, while still preserving the ability to use the property. Of course, some new properties will need to be verified. – Second, as an instance of our technique, the operator is applied to relax a well-known lemma stating the termination of the union of two termination abstract reduction systems. – Finally, this lemma is applied in a peculiar and then in a more general way to show the termination of some lambda calculi with inductive types augmented with specific reductions dealing with: (i) copies of inductive types; (ii) the representation of symmetric groups.

In this paper, we present an evaluation of the AADL Behavioural Annex that is currently in evaluation phase. We relate our experiment with respect to a development concerning the reengineering of a flight software. This experiments has led us to introduce hierarchical aspects and study the link especially with AADL modes. We discuss about the definition of a semantics for the AADL execution model and propose some enhancements.

This paper briefly presents the TOPCASED project which gathers industrialists, researchers, universities and SMEs, aiming at producing a free/open-source system/software/hardware-engineering toolkit, implemented over the Eclipse platform, using only standard components. An important aspect of TOPCASED is that it enables researchers to plug in their tools easily. TOPCASED is meant to be used on actual industrial projects and may therefore be considered as an important target by researchers working on formal methods and foundations of software engineering for critical systems

We study isomorphisms of inductive types (that is, recursive types satisfying a condition of strict positivity) in an extensional simply typed -calculus with product and unit types. We first show that the calculus enjoys strong normalisation and confluence. Then we extend it with new conversion rules ensuring that all inductive representations of the product and unit types are isomorphic, and such that the extended reduction remains convergent. Finally, we define the notion of a faithful copy of an inductive type and a corresponding conversion relation that also preserves the good properties of the calculus.