6 research outputs found
Enhancing Approximations for Regular Reachability Analysis
This paper introduces two mechanisms for computing over-approximations of
sets of reachable states, with the aim of ensuring termination of state-space
exploration. The first mechanism consists in over-approximating the automata
representing reachable sets by merging some of their states with respect to
simple syntactic criteria, or a combination of such criteria. The second
approximation mechanism consists in manipulating an auxiliary automaton when
applying a transducer representing the transition relation to an automaton
encoding the initial states. In addition, for the second mechanism we propose a
new approach to refine the approximations depending on a property of interest.
The proposals are evaluated on examples of mutual exclusion protocols
Tree Regular Model Checking for Lattice-Based Automata
Tree Regular Model Checking (TRMC) is the name of a family of techniques for
analyzing infinite-state systems in which states are represented by terms, and
sets of states by Tree Automata (TA). The central problem in TRMC is to decide
whether a set of bad states is reachable. The problem of computing a TA
representing (an over- approximation of) the set of reachable states is
undecidable, but efficient solutions based on completion or iteration of tree
transducers exist. Unfortunately, the TRMC framework is unable to efficiently
capture both the complex structure of a system and of some of its features. As
an example, for JAVA programs, the structure of a term is mainly exploited to
capture the structure of a state of the system. On the counter part, integers
of the java programs have to be encoded with Peano numbers, which means that
any algebraic operation is potentially represented by thousands of applications
of rewriting rules. In this paper, we propose Lattice Tree Automata (LTAs), an
extended version of tree automata whose leaves are equipped with lattices. LTAs
allow us to represent possibly infinite sets of interpreted terms. Such terms
are capable to represent complex domains and related operations in an efficient
manner. We also extend classical Boolean operations to LTAs. Finally, as a
major contribution, we introduce a new completion-based algorithm for computing
the possibly infinite set of reachable interpreted terms in a finite amount of
time.Comment: Technical repor
Verifying Programs with Dynamic 1-Selector-Linked Structures in Regular Model Checking
International audienceWe address the problem of automatic verification of programs with dynamic data structures. We consider the case of sequential, non-recursive programs manipulating 1-selector-linked structures such as traditional linked lists (possibly sharing their tails) and circular lists. We propose an automata-based approach for a symbolic verification of such programs using the regular model checking framework. Given a program, the configurations of the memory are systematically encoded as words over a suitable finite alphabet, potentially infinite sets of configurations are represented by finite-state automata, and statements of the program are automatically translated into finite-state transducers defining regular relations between configurations. Then, abstract regular model checking techniques are applied in order to automatically check safety properties concerning the shape of the computed configurations or relating the input and output configurations. For that, we introduce new techniques for the computation of abstractions of the set of reachable configurations, and to refine these abstractions if spurious counterexamples are detected. Finally, we present experimental results showing the applicability of the approach and its efficiency
Algorithmic Improvements in Regular Model Checking
Regular model checking is a form of symbolic model checking for parameterized and infinite-state systems, whose states can be represented as finite strings of arbitrary length over a finite alphabet, in which regular sets of words are used to represent sets of states. In earlier papers, we have developed methods for computing the transitive closure (or the set of reachable states) of the transition relation, represented by a regular length-preserving transducer. In this paper, we present several improvements of these techniques, which reduce the size of intermediate approximations of the transitive closure: One improvement is to pre-process the transducer by \em bi-determinization, another is to use a more powerful equivalence relation for identifying histories (columns) of states in the transitive closure. We also present a simplified theoretical framework for showing soundness of the optimization, which is based on commuting simulations. The techniques have been implemented, and we report the speedups obtained from the respective optimizations.Extended version of paper accepted for publication in in CAV'2003</p