S.GRAF C.LOISEAUX Keywords:abstractinterpretation,simulation,propertypreservation,model-checking. 1.Introduction

Transcription

1 VericationofConcurrentSystems* PropertyPreservingAbstractionsforthe c1995kluweracademicpublishers,boston.manufacturedinthenetherlands. FormalMethodsinSystemDesign,6,1{36(1995) S.GRAF C.LOISEAUX VERIMAG*,RueLavoisier,38330Monbonnot S.BENSALEM A.BOUAJJANI J.SIFAKIS ReceivedOctober1,1992;RevisedFebruary1,1994 Editor:DavidProbst oftwosystems.weproposeandstudyanotionofpreservationofpropertiesexpressedbyformulas S'.Wegiveresultsonthepreservationofpropertiesexpressedinsublanguagesofthebranching toverifyapropertyforasystembyverifyingthesamepropertyonasimplersystemwhichisan Abstract.Westudypropertypreservingtransformationsforreactivesystems.Themainideais abstractionofit.weshowalsounderwhichconditionsabstractionofconcurrentsystemscanbe computedfromtheabstractionoftheircomponents.thisallowsacompositionalapplicationof theproposedvericationmethod. Thisisarevisedversionofthepapers[2]and[16];theresultsarefullydevelopedin[28]. ofalogic,byafunctionmappingsetsofstatesofasystemsintosetsofstatesofasystem time-calculuswhentwosystemssands'arerelatedviah;i-simulations.theycanbeused theuseofsimulationsparameterizedbygaloisconnections(;),relatingthelatticesofproperties Keywords:abstractinterpretation,simulation,propertypreservation,model-checking. 1.Introduction tobeveried,nda(simpler)abstractprogramsuchthatthesatisfactiononthe consistsinusingpropertypreservingabstractions:givenaprogramandaproperty modelsthathavetobeconstructedfortheirapplication.manytechniqueshave itationofautomaticvericationtechniquesistheirapplicabilityonlytorelatively smallnitestateprogramsbecauseoftheexponentialblow-upofthesizeofthe beendevelopedinordertopushfurtherthelimitsofmodel-checking.oneofthem Thegrowingcomplexityofdistributedandreactivesystemsrequiresrigorousde- *ThisworkwaspartiallysupportedbyESPRITBasicResearchAction\REACT" velopmentmethodologiesandautomaticvericationtechniques.awell-knownlim- J.FourierandVerilogSAassociatedwithIMAG *VerimagisajointlaboratoryofCNRS,InstitutNationalPolytechniquedeGrenoble,Universite

2 2abstractprogramimpliesthesatisfactionontheinitialprogram,calledconcrete actlythisproblem.programsarerepresentedbyfunctionsfonsomelatticeof oftheconsideredproperties. byavailabletools,andthatstillcontainsenoughrelevantdetailsforthesatisfaction constructanabstractprogramthatisboth,simpleenoughinordertobeveried programinthiscontext.animportantpointis,givenaconcreteprogram,howto tiongontheabstractlatticeisanabstractionoffiffgholds.this formingagaloisconnection[35]fromtheconcretetotheabstractlattice,afunc- properties.givensomeabstractlatticeofpropertiesandapairoffunctions(;), [40],[41],theideaofabstractinterpretationhasbeenappliedtoprogramsrepresentedbytransitionsystems,wherethelatticeofpropertiesisthepowersetofstates. forthevericationofinvariancepropertiesofsequentialprograms.however,in ofcorrespondingxpointsoff.untilrecently,thisapproachhasonlybeenapplied guaranteesthatgreatestandleastxpointsofgrepresentupperapproximations Theframeworkofabstractinterpretation(seeforexample[7],[8])addressesex- There,resultsshowingpreservationoffragmentsofCTL[9]fromtheabstractto theconcretesystemhavebeengiven. sion(respectivelyequality)ofobservablecomputationsequences(seeforexample in[25],[1],[30]).however,thisnotionofabstractiondoesnotdirectlyinduceaway tionsofabstractionsaregenerallydenedintermsofvariantsofsimulation[31] andbisimulation[32];theproblemoftheconstructionofabstractprogramshas onlybeenaddressedfornotionsofabstractionsdenedbyequivalences. ordersandequivalenceshasalsobeenwidelystudied.inthisframework,theno- Inthelinearsemanticsframework,theintuitivenotionofabstractionisinclu- Intheframeworkofprocessalgebras,theproblemofpropertypreservingpre- coincidesexactlywiththenotionofabstractiondenedbysimulationinthesenseof criterion. Milner[31],parameterizedbytherelationcorrespondingtotheGaloisconnection abstractionontransitionsystemsasasimulationparameterizedbygaloisconnections(;).weshowthatthenotionofabstractioninducedbyh;i-simulation ofcomputinganabstractprogramforagivenconcreteprogramandobservability Here,wetakeupagaintheapproachfollowedin[40],[41].Wedeneanotionof fifforanystateofs1whichsatisesf,allthestatesofs2initsimagealsosatisfy f.iftheconversealsoholds,thenwesaythatstronglypreservesf.apreservation systems1tothepowersetofthestatesofatransitionsystems2preservesaproperty resultofparticularpracticalinterest,saysthatiftwosystemsarerelatedviah;isimulation,thenallformulasofthe-calculususingnonegationandonlyuniversal thebranchingtime-calculusdenedin[24]forthefollowingnotionofproperty preservation:anarbitraryfunctionfromthepowersetofthestatesofatransition Then,wegivepreservationresultsforfragmentsofafutureandpastversionof

3 quanticationovercomputationsequences(called2l)arepreservedbyefrom theabstracttotheconcretesystem(whereeisthedualof). structurehomomorphismfromtheconcretetoabstractsystem. studiedintheparticularcasewherethepropertypreservingfunctiondenesa Ourpreservationresultstogetherwiththefactthat,givensomeconcretesystem Thesepreservationresultsgeneralizeresultsgivenin[10]wherethisproblemis 3 composition,whichisimportantfortheapplicationofthismethodinpractice. andsomeconnection(;),anabstractsystemcanbecomputed,allowtheuse gramofacomposedsystembycompositionofabstractionsofitscomponents.it powersetsofconcreteandabstractstates,computetheassociatedabstractsystem Fromapracticalpointofview,therearetworeasonsforbuildinganabstractpro- SAandverifyfonSA.IffholdsonSA,italsoholdsonS. ofthefollowingvericationmethod.inordertoverifyaproperty expressed asaformulafof2l onasystems,provideaconnection(;)betweenthe iseasiertodeneconnections(;)separatelyforeachcomponentthanforthe compoundsystem;proceedingthisway,allowsalsotoavoidbuildingarepresentationoftheglobaltransitionsystemassociatedwiththecomposedsystem.aswell betweencomponents),wegivecompositionalityresults,thatmeansrules,allowing forsynchronousasforasynchronousparallelcomposition(allowingsharedvariables Finally,wegivearesultconcerningcompositionalityofsimulationoverparallel todeduceh;i-simulationforacompoundsystemfromhi;ii-simulationsforits thedenitionofgaloisconnectionsandsomeinterestingpropertiesofthem.in components,whereh;iisexpressedintermsofhi;ii. Section3,thedenitionofh;i-simulationisgiven.Weshowthatthisnotion coincideswiththeusualnotionofsimulation.insection4,wedeneanotionof \abstractprogram"obtainedfromagivenfunctionoritsassociatedrelation. Section6givesresultsconcerningthepreservationoffragmentsofthe-calculus toprovethatafunctionpreservesthevalidityofformulasofagivenlanguage. Section5presentsthenotionofpropertypreservationandgeneralresultsallowing whentransitionsystemsarerelatedviah;i-simulation.section7,givesresults Thepaperisorganizedasfollows.InSection2,wegivesomenotationsandrecall Finally,AnnexAcontainssometechnicalproofs. concerningthecompositionalityofsimulationwithrespecttoparallelcomposition. 2.Preliminarydenitions InSection3,westudytherelationshipbetweenthenotionsofabstractioninthe gramsaremodeledastransitionsystems,thatmeansasbinaryrelationsontheset ofstates.intheframeworkofabstractinterpretation,programsarerepresentedby denethebasicnotions,necessaryforthiscomparison.inprocessalgebraspro- frameworksofprocessalgebrasandofabstractinterpretation.inthissection,we predicatetransformers,i.e.,functionstransformingsetsofstatesintosetsofstates.

4 4WithanytransitionrelationRcanbeassociateddierentpredicatetransformers, concerningthem,whichareusedintheproofslateron. 2.1.Transitionsystemsandpredicatetransformers WerecallherethedenitionofGaloisconnectionandsomewell-knownproperties theforwardandbackwardimagefunctions,whichwedenoteherebypre[r],respectivelypost[r].intheabstractinterpretationframework,thenotionofabstraction Denition1(Transitionsystems) isbasedontheexistenceofagaloisconnectionbetweenthelatticesofproperties. AtransitionsystemisapairS=(Q;R),whereQisasetofstatesandRisa transitionrelationonq(rqq). Notation1Weadoptthefollowingconventionsandnotations: WeidentifyaunarypredicateonQwithitscharacteristicsetsincethelattice WedenotebyIdQtheidentityfunctionon2Q. GiventworelationsRQQ0andSQ0Q00andtwofunctionsf:Q!Q0 stateq2q,thenotationsp(q)=true,p(q)andq2pareequivalent. ofunarypredicatesisisomorphicto2q.thus,foraunarypredicatepanda asasetofstates(oracorrespondingunarypredicate).therefore,inthesequel \propertylattice"isalwaysthesameas\powersetonthesetofstates". Denition2(Thepredicatetransformerspreandpost) Inthesequel,weconsideralwayspropertiestobestateproperties,i.e.,interpreted gfisappliedtosomeargumentq2q. andg:q0!q00,thendenotethecompositionoftherelationsrandsbyrs GivenarelationQ1Q2,wedenepre[]:2Q2!2Q1andpost[]:2Q1!2Q2 andthecompositionofthefunctionsfandgbygf,respectivelyg(f(q))if statesofq20viatherelationandforq10q1,post[](q10)representsthesetof \successors"ofthestatesofq10via.noticethatwehavepost[]=pre[?1]. by,pre[]def Thatmeans,forQ20Q2,pre[](Q20)representsthesetof\predecessors"ofthe post[]def =X:fq12Q1:9q22X:q1q2g formerspreandpostwhichcanforexamplebefoundin[41]. Thefollowingpropositionsgivesomeusefulresultsconcerningthepredicatetrans- =X:fq22Q2:9q12X:q1q2g Proposition1ForanyrelationfromasetQ1toasetQ2(Q1Q2),we have:

5 Notation2(Dualofafunction) 2.ForanyX1,X2subsetsofQ2,pre[](X1[X2)=pre[](X1)[pre[](X2), 1.pre[](;)=;, 5 Wedenotebyethedualofafunction:2Q1!2Q2thatis Proposition2LetbeQ1Q2andQ2Q3.Then, edef pre[]=pre[]pre[], post[]=post[]post[], =X:(X). 2.2.Galoisconnections WegivehereafterthedenitionofGaloisconnectionsandsomeusefulwell-known resultsaboutthem.moreinformationcan,e.g.,befoundin[35],[39]. gpost[]=gpost[]gpost[]. fpre[]=fpre[]fpre[], LetQ1andQ2betwosetsofstates.Aconnectionfrom2Q1to2Q2isapairof Denition3(Connections) IdQ1andIdQ2. Proposition3Foranyconnection(;)from2Q1to2Q2,wehave, monotonicfunctions(;),where:2q1!2q2and:2q2!2q1,suchthat =,and=, (;)=;, distributesover[anddistributesover\, (e;e)isaconnectionfrom2q2to2q1. Proposition5Foranyconnection(;)from2Q1to2Q2,wehave, Proposition4LetF:2Q1!2Q1andG:2Q2!2Q2betwofunctionsand(;) aconnectionfrom2q2to2q1.then, 8QQ1;Q0Q2:(Q)Q0iQ(Q0). =Y:SfX22Q1:(X)Yg, FGifandonlyifFG

6 betweentheconnectionsfrom2q1to2q2andthebinaryrelationsfromq1toq2. 6=X:TfY22Q2:X(Y)g. Proposition6(Connectionsgeneratedbyabinaryrelationonstates) characterizationsallowtodeducethefollowingtwopropositionsshowingthelinks IfQ1Q2,thenthepair(post[];fpre[])isaconnectionfrom2Q1to2Q2and (pre[];gpost[])isaconnectionfrom2q2to2q1. Proposition7(Relationsinducedbyconnections) Thatmeansthatanddetermineeachotherinauniquemanner.These If(;)isaconnectionfrom2Q1to2Q2,thenthereexistsauniquerelation by(q1;q2)2ifandonlyifq22(q1).since(;)=;anddistributesover[ (Proposition3),wehave=post[]. Q1Q2suchthat=post[]and=fpre[]. Proof:Let(;)beaconnectionfrom2Q1to2Q2.Considertherelationdened tionfrom2q2to2q1,thenwehave, Proposition8If(;)isaconnectionfrom2Q1to2Q2and(0;0)isaconnec- andasdistributesover[,wecanwrite=y:fq2q1:(fqg)yg.now, since=post[],itiseasytodeducethat=fpre[]. Furthermore,bytheProposition5,wehave=Y:SfX22Q1:(X)Yg, Proof:ConsidertherelationQ1Q2suchthat=post[]and=fpre[], whichexistsbyproposition7. totalonq1andidq2post[]pre[]foranyq1q2thatistotalonq2. Now,itiseasytoseethatIdQ1pre[]post[]foranyQ1Q2thatis 1.IdIm(e)eandIdIm()e, pre[0]pre[]pre[0]=pre[0]forsomeappropriaterelations;0.byproposition2,thisisequivalenttopre[00]=pre[0],thatis0=00. Symmetrically,0=00isequivalenttopost[0]=post[00],thatisto ByProposition7,theequatione0ee0=e0isequivalentto 2.e0ee0=e0ifandonlyif00=0. Inthissection,wedeneanotionofsimulationbasedonGaloisconnections(;), 3.Simulations calledh;i-simulation.itsdenitionisinspiredbythenotionofabstractinterpretationinthesenseofcousot[7],[8].there,aprogramisrepresentedbyafunction Fmappingpropertiesintoproperties.AfunctionG,mappingabstractproperties post[0]=post[0]post[]post[0],i.e.,0=00.

7 intoabstractproperties,isanabstractionoffifthereexistsaconnection(;) fromthetheconcretetoabstractlatticeofproperties,suchthatfg. blechoiceforthefunctionfistakingoneofthepredicatetransformersassociated stractionofs"and\ssimulatessa"areequivalent.weshowthatthenotionof withthetransitionrelationr.weconsiderthattheexpressions\saisanab- Inourframework,whereaprogramisatransitionsystemS1=(Q1;R1),apossi- 7 abstractioninducedbythechoicef=pre[r1]coincideswiththenotionofabstractioninducedbysimulationinthesenseofmilner[31]whichisusedinthe S2=(Q2;R2),i.e.,aconnectionfrom2Q1to2Q2. (;)relatingthepropertylatticesoftwotransitionsystemss1=(q1;r1)and frameworkofprocessalgebras. 3.1.Simulationsinducedbyconnections Denition4(vh;iand'h;i) LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystemsand(;)bea First,wedenesimulation(andbisimulations)parameterizedbyaconnection connectionfrom2q1to2q2.dene, fromproposition4. IfS1vh;iS2,wesaythatS1h;i-simulatesS2orS2isanh;i-abstractionof S1.Ausefuldualconditionforthedenitionofh;i-simulationcanbededuced S1'h;iS2ifandonlyifS1vh;iS2andS2vhe;eiS1. S1vh;iS2ifandonlyifpre[R1]pre[R2], Q1andQ2.InPropositions9and10weshowthatthesetwonotionsofsimulation senseofmilnerwhicharebasedonabinaryrelationbetweenthesetsofstates 3.2.Relatingh;i-simulationandbehaviouralsimulation coincide. Denition5(vand') Werecallrstthedenitionsofbehaviouralsimulationandbisimulationinthe LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystemsandbearelation fromq1toq2(q1q2).dene, S1'S2ifandonlyifS1vS2andS2v?1S1. S1vS2ifandonlyifR1?1R2?1,

8 suchthats1vs2(respectivelys1's2).weshownowthath;i-simulation and-simulationcoincide. 8IfS1vS2,wesaythatS1-simulatesS2orS2isa-abstractionofS1. Q1Q2,thereexistsaconnection(;)from2Q1to2Q2suchthat Proposition9(Fromvh;itov) S1vS2ifandonlyifS1vh;iS2. LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystems.Foranyrelation S1simulates(respectively,bisimulates)thesystemS2ifthereexistsarelation Proof:Weshowthattheintendedconnectionis(post[];fpre[])(byProposition6, thispairisindeedaconnection).supposethats1vhpost[];fpre[]is2,i.e., Then,aspost[]ismonotonicandIdQ1fpre[]post[],weobtain, post[]pre[r1]fpre[]pre[r2]. Proposition10(Fromvtovh;i) LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystems.Foranyconnection Itcanbeshowninasimilarwaythattheconversealsoholds.Thisproves, post[]pre[r1]fpre[]post[]pre[r2]post[]whichimplies (;)from2q1to2q2thereexistsarelationq1q2suchthat post[]pre[r1]pre[r2]post[]whichisequivalenttor1?1r2?1. S1vh;iS2ifandonlyifS1vS2. S1'hpost[];fpre[]iS2ifandonlyifS1'S2. abstractioninthecasewhereprogrammodelsaretransitionsystemsisthesame. Therefore,wedonotdistinguishinthesequelbetweensimulationsparameterized tationandthatchosenintheframeworkofprocessalgebra.infact,thenotionof byrelationsandthoseparameterizedbyconnections;inanycontextweusethe notionwhichallowstopresenttheresultsinthesimplestway. Proof:DirectfromPropositions7and9. 4.Computingprogramabstractions Thisresultclariestherelationshipbetweentheapproachofabstractinterpre- Intheframeworkofprocessalgebraandofprogramrenement,thenotionofsimulationisingeneralusedinordertodecidefortwogivenprogramsifoneofthem simulatestheother.butouraimis,givenaprogrampandarelationrelating concreteandabstractstates,toconstructanabstractprogrampasuchthatp -simulatespa.obviously,therearemanyprogramswhichare-abstractionsof

9 i.e.whichisascloseaspossibletotheconcreteprogram. anabstractprogramsatisfying foragiven asmanypropertiesaspossible, theabstractprogrammustalsoberepresentablebysometransitionrelationofthe theabstractsetofstatesisatrivial-abstractionofanyp.weareinterestedin P.InparticulartheprogramChaosdenedbytheuniversaltransitionrelationon Inourframework,wherePisrepresentedbyatransitionsystemS=(Q;R) 9 ofs.insection4.1,wedenerstthecriteriumoffaithfulnesswhichissatised byalltransitionsystemsonqawhicharebisimilartoanysmaller(inthesense ofinclusion)-abstractionsofs.usingtheresultsofsection5,wewillseethat simulation,doesnotnecessarilycorrespondtoasolution,thatmeansafunctionof theformpre[ra]forsometransitionrelationra. formsa=(qa;ra),whereqaisthesetofabstractstates.inthiscasethe faithfulabstractionsarethesetofabstractprogramswhichsatisfyallproperties obviousminimalfunctionpost[]pre[r]fpre[] obtainedfromthedenitionof whicharepossiblysatisedbyany-abstractionofsandwhicharepreservedfrom SAtoS. Itiseasytoseethatingeneral,theremayexistseveral\minimal"-abstractions thecasethatisatotalfunction,pre[]=fpre[]holds,whichtriviallyimpliesthat vwhichwedenoteby.undersomeconditionscoincideswiththenotionof S;thiscasehasbeenwidelystudiedintheliterature(seeforexamplein[25],[10]). Sistheleastabstraction.Then,denesastructurehomomorphismfromSto?1Risafaithfulabstractionifistotalandmoreover=?1holds.In forwardandbackwardsimulationforwhichweobtainstrongerpreservationresults WewillseethattheabstractprogramdenedbyS=(QA;R)withR= andillustratethisonasmallexample. thanforv. abstractionrelationsarerepresentedbypredicatesoversetsofprogramvariables Sisinducedinanobviousmannerbyaslightlystrongernotionofsimulationthan 4.1.Faithfulabstractions Denition6(Faithfulabstractions) GivenS=(Q;R)andQQA,wesaythatSA=(QA;RA)isafaithful InSection4.2,weshowhowScanbecomputediftransitionrelationsaswellas abstractionofsviaifsvsaand8s0=(qa;r0):svs0andr0ra implies90qaqa:sa'0s0. Proposition11LetS=(Q;R)beatransitionsystemandQQA. R=?1R(orequivalently,pre[R]=post[]pre[R]pre[]). GivenS=(Q;R)andQQA,totalonQ,wedeneS=(QA;R)where Notation3(ThesystemS) IfistotalonQ,thenSvS.

10 Proof:Therstandthethirditemsfollowdirectlyfromthefactthatfpre[]pre[] 10Iffurthermore=?1,thenSisafaithfulabstractionofSvia. ifistotalonq(respectivelyfpre[]=pre[]ifisafunction).forthesecond item,weshowthatforanytransitionsystemsa=(qa;ra)suchthatsvsaand RAR,wehaveSA'?1S,theproofofwhichisgivenintheAppendixA.1. Ifisa(total)function,thenSistheleast-abstractionofS.?1.Thereexistexamplesofinterestingabstractionrelationssuchthatisnot fromthepartitiononqinducedby?1intothepartitionofqainducedby successorby,havethesamesuccessorsby.thismeansthatdenesafunction function.if=?1doesnothold,thensisnotnecessarilyfaithful,andin[12] isgivenawaytocomputefaithfulabstractions. vh;i)whichcoincideswiththenotionofforwardandbackwardsimulationused, e.g.in[21],[22]ifistotal. Sisinducedbyaslightlystrongernotionofsimulationthanv(respectively Noticethat=?1ifandonlyifanytwostatesofQhavingacommon Denition7(andh;i) LetS=(Q;R)andSA=(QA;RA)betransitionsystems,andQQAtotal Lemma1(Characterizationof) onqand(;)atotalconnectionfrom2qto2qa.then, LetS=(Q;R)andSA=(QA;RA)betransitionsystems,andQQAtotal onq;denotes?1=(q;r?1)andanalogouslyforsa.then, SSAifandonlyif?1RRA Sh;iSAifandonlyifpre[R]epre[RA] Now,weconsidertheparticularcasewheretransitionrelationsandabstraction 4.2.Symboliccomputationofprogramabstractions relationsarerepresentedbypredicatesoverprogramvariables.thesetsofstates QaretheCartesianproductofthedomainsofatupleofprogramvariables.For SSAifandonlyifSvSAandS?1vS?1 example,ifx=(x;y),thenwehave,q=dom(x)=dom(x)dom(y). theformr(x;x0)wherex0=(x0;y0)isa\copy"ofx,i.e.,dom(x)=dom(x0). XencodesthesourcestateandX0thetargetstateofanytransitioninR.For example.,ifdom(x)=nanddom(y)=bool,thenr=y^(x0=x+1) Then,binaryrelationsonDom(X)canberepresentedbybinarypredicatesof

11 representsthetransitionrelationrelatingany(n;true)2nboolwith(n+1;b0) Thisapproachisused,e.g.,in[27],[37].InthesamewayarelationfromDom(X) whereb0maytakeanybooleanvalueasy0isnotconstraintintheexpressionr. todom(xa)isrepresentedbyabinarypredicateoftheform(x;xa). connectives.forexample,thefactthatarelationr1isincludedinr2isexpressed Inthissetting,operationsonsets(respectivelyrelations)areexpressedbylogical 11 Section7. areusedaslabels(names)forsynchronizationpurposesinparallelcompositionin ofbinarypredicatesonthesametupleofvariables,s=fri(x;x0)gi2iwherei2i onthesamesetofvariables. byr1)r2andr1^r2representstheintersectionofr1andr2iftheyaredened ables,theabstractionsofsiscomputedas Then,givenanabstractionrelation(X;Y),whereYisatupleofabstractvari- Weconsiderthataprogramisafamilyoftransitionrelationsrepresentedbysets containingexpressionsinwhich,atleastinthecasewheredom(x)anddom(y) arenite,alloccurrencesofvariablesxandx0canbeeliminated. Example:areader/writerproblem Wedescribeasimplereaders/writerssystembythefollowing\program"RW;in S=f9X9X0:(X;Y)^(X0;Y0)^Ri(X;X0)gi2I factrwdenesafamilyoflabeledtransitionrelationswhereforreadabilityreasons anexplicitlabel((b-read),(e-read),...)ofeachactionisputbetweenparenthesesin frontoftheexpressiondeningthetransitionrelation. RW=f (b-read)(wr>0)^(aw=0)^(wr0=wr?1)^(ww0=ww)^ (e-read)(ar>0) (b-write)(ww>0)^(aw=0)^ (Ar=0) ^(Wr0=Wr+1)^(Ww0=Ww)^ ^(Wr0=Wr)^(Ww0=Ww?1)^ (Ar0=Ar+1)^(Aw0=Aw); (Ar0=Ar?1)^(Aw0=Aw); wherewrandwwarepositiveintegervariablesrepresentingrespectivelythenumbersofwaitingreadersandwaitingwriters,arandawrespectivelythenumbers ofactivereadersandactivewriters.thetransitionrelationassociatedwithrw (e-write)(aw>0) (n-wait) g ^(Wr0=Wr)^(Ww0=Ww+1)^ ((Wr0=Wr+1)_(Ww0=Ww+1))^ (Ar0=Ar)^(Aw0=Aw+1); hasaninnitenumberofstatesaswrandwwcanalwaysbeincreasedbyaction (n-wait). (Ar0=Ar)^(Aw0=Aw?1), (Ar0=Ar)^(Aw0=Aw)

12 relevantinformationis,whetherthenumberofactivereadersandwritersispositive 12 Wewanttoprovemutualexclusionbetweenreadersandwriters.Then,theonly ornot.therefore,wedeneanabstractionrelationmappingtheprogramvariablesontwobooleanvariablesb1andb2meaningrespectively\thereisnoactive reader"and\thereisnoactivewriter",by thevetransitionrelationsriofrwwehavetocomputetheabstracttransition Asisatotalfunction,RWisafaithfulabstractionofRWvia.Foreachoneof pression: ForthetransitionrelationR1(labeledby(b-read))oneobtainsthefollowingex- (Ri)=9X9X0:(X;Y)^(X0;Y0)^Ri(X;X0) ((Wr;Ww;Ar;Aw);(b1;b2)):=(b1(Ar=0))^(b2(Aw=0)). relation (R1)=9(Ar;Aw;Wr;Ww)9(Ar0;Aw0;Wr0;Ww0): transitionrelations: BydoingasimilarcomputationforallRiweobtainthefollowingfamilyofabstract RW=f(b-read)b2 (b1(ar=0))^(b2(aw=0))^(b01(ar0=0))^(b02(aw0=0))^ (Wr>0)^(Aw=0)^(Wr0=Wr?1)^ (Ww0=Ww)^(Ar0=Ar+1)^(Aw0=Aw) =b2^:b01^b02 (e-read):b1^(b02b2), (e-write):b2^(b01b1), (b-write)b1^b2^b01^:b02, (n-wait) ^:b01^b02, Nowwehavedenedanotionofabstractionandawaytocomputeabstractprograms.Animportantpointistoknowforwhichpropertieswecandeducefrom TheniteglobaltransitionrelationrepresentedbyRWisgivengraphicallyin Figure Generalresultsonpropertypreservation (b01b1)^(b02b2)g thesatisfactionontheabstractsystemitssatisfactionontheconcretesystem.in allstatesofq2initsimagebysatisfypropertyf.wehavestrongpreservation iftheinverseholdsalso;thismeansintuitivelythatwheneverastateofq1does relatedviasomemonotonicfunction:2q1!2q2,thenthesatisfactionofsome statepropertyfispreservedfroms1tos2viaifforanystateofq1satisfyingf ordertoanswerthisquestion,weconsiderrstthegeneralproblemofproperty notsatisfyf,thenthereexistsastateinitsimagebywhichdoesnotsatisfyf. preservationbetweentwosystems.ifthepropertylatticesofthetwosystemsare

13 (b1;b2) 13 (b1;b2) e-write e-readb-write (b1;b2) b-reade-write e-read Figure1.Readers/Writersabstraction (b1;b2) b-read e-read expressedbyformulasofalogicallanguagef(p)wherep=fp1;p2;:::gisa setofpropositionalvariables.foragivensystems=(q;r)andaninterpretationfunctioni:p!2q,thesemanticsoff(p)isgivenbymeansofafunction that(;)isaconnection,becauseinsection6weapplythisnotionofpreservation Wegiveusefulcharacterizationsofthesedenitionsifthereexistsafunctionsuch jjs;i:f(p)!2q,associatingwitheachformulaitscharacteristicset,i.e.,theset ofstatessatisfyingit.thisfunctionissuchthat8p2p:jpjs;i=i(p). strongpreservationfrompreservationinbothdirections. tosystemsrelatedviah;i-simulation.wegivealsoatheoremallowingtodeduce omittedwhenevertheirvaluescanbedeterminedbythecontext. Tosimplifynotations,eitheroneorbothofthesubscriptsSandIinjfjS;Iwillbe Letusrstintroducesomenotations.Wesupposethatprogrampropertiesare anyq2, thatpreserves(respectivelystronglypreserves)fforionifandonlyiffor Letf2F(P)beaformula,S1=(Q1;R1)andS2=(Q2;R2)betwotransition If=Q1,weomittomentionthatthepreservationison. Denition8(Preservation) systems,q1,i:p!2q1aninterpretationfunctionand:2q1!2q2.wesay ofs1andpropertiesofs2.preservationmeansthatthefunctioniscompatible withthesatisfactionrelation.inthesequel,wherethefunctionunderconsiderationisalwaysmonotonic,andevensuchthatthereexistsafunction,such Inthisdenition,thefunctionestablishesacorrespondencebetweenproperties q2jfjs1;iimplies(respectivelyifandonlyif)(fqg)jfjs2;i. that(;)isaconnection,weusethefollowingcharacterizationsofthenotionof preservationinordertoestablishpreservationresults.

14 Letf2F(P)beaformula,S1=(Q1;R1)andS2=(Q2;R2)betwotransition 14 Lemma2(Characterizationofpreservation) systems,i:p!2q1beaninterpretationfunctionand:2q1!2q2. 1.ifismonotonicthen 2.ifthereexistssuchthat(;)isaGaloisconnection,then (A)preservesfforIifandonlyif (jfjs1;i)jfjs2;iimpliespreservesffori andifdistributesover[,theconversealsoholds. Theproofof(2A)isdirectfrom(1)andthelastitemofProposition3.(2B)can (jfjs1;i)=(sq2jfjs1;ifqg)=sq2jfjs1;i(fqg)whichestablishestheresult. Proof:Therstdirectionof(1)isimmediate:fromq2jfjS1;I,weobtainby monotonicityof,(fqg)(jfjs1;i)jfjs2;i.ifdistributesover[,then (B)stronglypreservesfforIifandonlyif jfjs1;i=(jfjs2;i) jfjs1;i(jfjs2;i) thatthereexistsfunctions,0suchthat(;)and(0;0)areconnectionsdoes tos2.noticethatthistheoremusesonlythemonotonicityofand0;thefact bededucedfromthefactthat((fqg)jfjs2;i))q2jfjs1;iisequivalentto Sf(q)jfjS2;IgfqgjfjS1;Iand notallowtoweakentheconditionsrequiredhere.therefore,weuseexactlythis theoreminordertoobtainthestrongpreservationresultsinthefollowingsection. ThefollowingtheoremgivesconditionsunderwhichpreservationbyfromS1to Sf(q)jfjS2;Igfqg=(jfjS2;I)byProposition5. Theorem1(Preservationandstrongpreservation) LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystems.Foranyset S2andpreservationby0fromS2toS1impliesstrongpreservationbyfromS1 that00=0andid0,ifpreservesffori:p!im(0)and0 Q1andforanymonotonicfunctions:2Q1!2Q2and0:2Q2!2Q1such (fqg)jfjs2;i.wehave, preservesfforithenstronglypreservesfforion. Proof:Inordertoshowstrongpreservationbysupposethat,forq2, I=0I0.Thus0I=00I0=0I0=Iwhichimpliesq2jfjS1;I. SinceI:P!Im(0),thereexistsaninterpretationfunctionI0:P!2Q2suchthat 0(fqg)0(jfjS2;I)(monotonicityof0), q20(jfjs2;i)(id0), q2jfjs1;0i(0preservesfforiandlemma2).

15 augmentedbypasttimemodalities,whichwedenotelp. simulationasdenedinsection3.theuniverseofpropertiesthatweconsideris thesetofpropertiesexpressibleinthepropositionalbranching-time-calculus[24] 6.Preservationofthe-calculus Nowwecantackletheproblemofpreservationbetweensystemsrelatedbyh;i- 15 suchasthebranching-timetemporallogicsctl[9]andctl[14]andalsothe forthefragmentsaugmentedbythecorrespondingpasttimemodalityholdalso. linear-timetemporallogicsasptl[36]andetl[42]. pstandsforlogicscontainingpasttimeoperators).weshowfortwosystemss1and S2that,ifS1vh;iS2,thenpreserves3LfromS1toS2andepreserves2L froms2tos1.ifmoreovers1h;is2holds,thenstrongerpreservationresults Thislogicsubsumesinexpressivenessthecommonlyusedspecicationlogics, i.e.,existenceofsimulationsinbothdirections. tionedabovepreservel(p) Weobtainstrongpreservationofthesefragmentsincaseofsimulationequivalence, Inthecasewherethetwosystemsareh;i-bisimilar,thetwofunctionsmen- Wedenefragmentsofthe-calculuscalledL,2L,2Lp,3L,and3Lp(where tion,wereformulatethevericationmethodsketchedintheintroductionandapply ittothesmallexampleintroducedinsection Thepropositional-calculusanditsfragments andinthesecondsubsectionwegivethepreservationresults.inthethirdsubsec- Intherstsubsection,werecallthedenitionofthe-calculusanditsfragments and,undersomeconditions,theystronglypreserveit. Werecallthesyntaxandthesemanticsofthefutureandpastpropositional-calculus Asusually,thenotionoffreeoccurrencesofvariablesinaformulaisdenedasin formulasoflpisdenedbythefollowinggrammar: Lp.LetPbeasetofatomicpropositionsandXasetofvariables.Thesetofthe therst-orderpredicatecalculusbyconsideringtheoperatorasaquantier.a wherefissyntacticallymonotoniconx,i.e.,anyoccurrenceofxinfis f::=>jp2pjx2xj3fj3pfjf_fj:fjx:f andaninterpretationfunctionfortheatomicpropositionsi:p!2q.aformulaf inwhichthepastoperator3pisnotallowed. formulaisclosediftherearenovariablesoccurringfreeinit.listhefragment ThesemanticsoftheformulasisdenedforagiventransitionsystemS=(Q;R) underanevennumberofnegations. aclosedformulaisinterpretedasasetofstates.theinterpretationfunctionis withnfreevariablesisinterpretedasafunctionjfjs;i:(2q)n!2q.inparticular,

16 16 inductivelydenedasfollows,foravaluationv=(v1;:::;vn)2(2q)nofthevariablesoccurringfreeinit. j>js;i =Q, jpjs;i =I(P), jxjjs;i(v)=vj, jf1_f2js;i(v)=jf1js;i(v)[jf2js;i(v), j:fjs;i(v)=q?jfjs;i(v), j3fjs;i(v)=pre[r](jfjs;i(v)), j3pfjs;i(v)=post[r](jfjs;i(v)), jx:fjs;i(v)=tfq0q:jfjs;i[q0=x](v)q0g: WeextendLpbyaddingasusuallytheformulas?,f^g,f)g,X:f(X),2fand 2pfwhicharerespectivelyabbreviationsfor:>,:(:f_:g),:f_g,:X::f(:X), :3:fand:3p:f. Aformulaofthisextendedlanguageisinpositivenormalformifandonlyifall thenegationsoccurringinitareappliedtoatomicpropositions.itcanbeshown thatanyformulaoflphasanequivalentformulainpositivenormalform. WedenefragmentsofLpcalled2L,2Lp,3Land3Lp.Theirsetsofformulas aregivenrespectivelybythetwofollowinggrammarswherethepasttimemodalities 2pand3parenotallowedinthefuturefragments2L,respectively3L. g::=>j?jpj:pjxj2gj2pgjg_gjg^gjx:gjx:g h::=>j?jpj:pjxj3hj3phjh_hjh^hjx:hjx:h Noticethatpropertiesexpressedbyformulasof2L(p) involveonlyuniversalquanticationovercomputationsequences(duetotheuseofthe2(or2p)operator) whereasthoseexpressedbyformulasof3l(p) involveonlyexistentialquantication overcomputationsequences. Weconsiderthepositivefragments2L(p)+ and3l(p)+ obtainedfromtheabove languagesbyforbiddingtheuseofthenegationevenonatomicpropositions.we consideralsothefragmentsl(p)+ correspondingtothesubsetofl(p) formulasin positivenormalformwithoutnegations.wecantranslateanyformulaofl(p) which isinpositivenormalformintoanequivalentformulainl(p)+ byreplacingnegated atomicpropositions,i.e.,formulasintheform:p,bynewatomicpropositions. Thus,sinceanyformulaofL(p) hasanequivalentformulainpositivenormalform, wecanexpressinl(p)+ anypropertyexpressibleinl(p),modulothisencodingof theformulas:p.obviously,thesametranslationcanbedonefroml(p) tol(p)+ for2f2;3g. In2Lwecanexpressbranching-timepropertiesasforinstancethesafetypropertieswithrespecttothesimulationpreorder[3].Theclassoftheseproperties correspondstothefragmentof2lwithouttheleastxpointoperator.

17 pressiblebyanondeterministicbuchiautomaton[6],canbeexpressedin2l[4]. Forexample,thesafetyproperty[26],[29],[34]\alwaysP"canbeexpressedby theformulax:(p^2x).moreover,theguaranteeproperty(accordingto[34]) mulax:(p_2x).propertiesintheotherclassesinthehierarchygivenin[34] \eventuallypinanyinnitecomputationsequence"canbeexpressedbythefor- Furthermore,itcanbeshownthatany!-regularlinear-timeproperty,i.e.,ex- 17 areobtainedbyusingalternationsoftheandtheoperators.thepropertiesof 8CTL*canbeexpressedin2Lifwerestrictourselvestomodelswhosetransition relationistotalas8ctl*allowstoexpressgeneraleventuality.noticethatifthe isexpressedbytheformulax:(p_3true^2x),whichisneitherin2lnorin transitionrelationoftheconsideredmodelsisnotnecessarytotal,\eventuallyp" 3L. :P)X:(:init^2pX). rithmsforinvariantsandeventuallypropertieswhichinsomecasesconvergemuch faster.forexample,theformulainit)x:(p^2x)isequivalentto init.moreover,theymaybeusedinordertodenealternativecomputationalgo- propertieswhichcannotbeexpressedusingonlyfuturemodalities,e.g., X:(init_2pX)holdsexactlyinthesetofstatesreachablefromastatesatisfying Pasttimemodalitiescanbeusedfortwodierentaims:theyallowtoexpress Theformulasof3Larenegationsofformulasof2Landconversely. relatingtwopropertylattices,:2q1!2q2,preservesthemeaningoftheatomic First,wedenethenotionofconsistencywhichexpressesthatachosenfunction 6.2.Preservationresults propositionsdenedbyaninterpretationfunctionion2q1.isconsistentwith :2Q1!2Q2.Then,isconsistentwithIif i.e.,theimagesbyoftheinterpretationofpandof:parenoncontradictory. Lemma3saysthat inthecasethat(;)isaconnection consistencyof atomicpropositions. Denition9(Consistency) LetQ1andQ2betwosetsofstatesandI:P!2Q1aninterpretationandafunction withiexpressesthefactthatestronglypreservestheinterpretationofall IifforallatomicpropositionstheimagesofI(P)andI(P)byaredisjoint, aconnection,thenisconsistentwithiifandonlyif UnderthesameassumptionsasinDenition9,ifthereexistssuchthat(;)is Lemma3(Characterizationofconsistency) 8P2P:(I(P))\(I(P))=; 8P2P:((I(P)))=I(P)

18 18 Proof:AproofbycontradictioncanbeobtainedusingProposition7. Now,wegiveatheoremaboutthepreservationinthecasethatfortwogiven systemss2ands2arerelatedbys1vh;is2.thetheoremsaysthatpreserves formulasof3lfroms1tos2,epreservesformulasof2l(p) froms2tos1andif evens1'h;is2holds,thenaswellasepreservethewholel.furthermore, ifonereplacesvh;ibyh;i,oneobtainsanalogouspreservationresultsforthe fragmentsaugmentedbythecorrespondingpastmodalities. Theorem2(Preservationof2L(p),3L(p) andl(p) ) LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystemsandI1:P!2Q1, I2:P!2Q2twointerpretationfunctions. 1.IfS1vh;iS2(respectivelyS1h;iS2),then (A)preservestheformulasof3L+(respectively3Lp+ )fori1,andifis consistentwithi1thenpreservestheformulasof3l(respectively3lp) fori1. (B)epreservestheformulasof2L+(respectively2Lp+ )fori2,andifeis consistentwithi2thenepreserves2l(respectively2lp)fori2. 2.IfS1'h;iS2(respectivelyS1h;iS2andS2he;eiS1)thenpreserves theformulasofl+(respectivelylp+ )fori1andifisconsistentwithi1then preservestheformulasofl(respectivelylp)fori1. Proof:TheproofthatpreservesL+ifS1'h;iS2consists,duetoLemma2, inshowingthatforanyformulaf2l+andforanyvaluationv,wehave (jfjs1;i1(v))jfjs2;i1((v)). Theproofisdonebyinductiononthestructureoff,andforalloperators(includingxpointoperators),except3and2weneedonlythemonotonicityofin ordertoestablishthisfact.for3weneedthefactthats1vh;is2andfor2 weneedthefactthats2vhe;eis1.thisproofisgiveninappendixa.2. TheproofofpreservationofLp+ undertheconditionthats1h;is2isobtained bylemma1sayingthatforwardandbackwardsimulationimpliess1vh;is2 ands1?1vh;is2?1(wheresi=(qi;r?1 i))andtheobservationthatpost[r]= pre[r?1]. Finally,ifisconsistentwithI1,itisstraightforwardtodeducethat (j:pjs2;i1)j:pjs1;i1. NoticethatwehavealsopreservationofLp+ byebyexchangingtherolesof andeandofs1ands2andthenusingsymmetricalarguments.now,theproofs of(1a)and(1b)areobviousfromthefactthatforthepreservationof3l(p)+ by weneedonlytheconditionthats1vh;is2(respectivelys1h;is2),and forthepreservationof2l(p)+ byetheconditionthats1vhe;eis2(respectively

19 S1he;eiS2),whichisequivalenttoS1vh;iS2(respectivelyS1h;iS2). ItisknownthatinordertohavestrongpreservationofLoneneedstheexistenceof abisimulationbetweenthetransitionsystemss1ands2(theorem4givestheexact 19 offragmentsoflundertheweakerconditionthatistheexistenceofamutual conditions).byusingtheorem1,oneobtainsfromtheorem2strongpreservation simulationbetweens1ands2andtheadditionalconditionsrequiredintheorem1: Theorem3(Strongpreservationof2L(p) LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystems.IfS1vh;iS2 ands2vh0;0is1(respectivelys1h;is2ands2h0;0is1)for;0such that00=0,then 1.IfId0forsomeQ1,then Furthermore,ifisconsistentwithI,thenstronglypreserves3L(respectively3Lp)forIon. stronglypreserves3l+(respectively3lp+ and3l(p) 2.IfIde0eforsomeQ2,then Theorem4(StrongpreservationofL(p) Proof:(1)isadirectapplicationofTheorem1usingTheorem2.(2)isobtained inthesamewaybyusingproposition8whichguaranteese0ee0=e0. tively2lp)forion. Furthermore,ifeisconsistentwithI,thenestronglypreserves2L(respec- estronglypreserves2l+(respectively2lp+ ) )onforanyinterpretationi:p!. LetS1=(Q1;R1)andS2=(Q2;R2)betwotransitionsystems.IfS1'h;iS2 (respectivelys1h;is2ands2he;eis1)andee=ethen taineddirectlyfromtheorems1and2byreplacing0byeandusingthefact Proof:Astheprecedingtheorem,theproofofstrongpreservationbyisob- 1.stronglypreservesL(respectivelyLp)onIm(e)foranyinterpretation thatidim(e)e(proposition8)andthefactthatisconsistentwithany 2.estronglypreservesL(respectivelyLp)onIm()foranyinterpretation I1:P!Im(). I1:P!Im(e)and I1:P!Im()byusingthesameargumentsasintheproofofTheorem1.The proofforeissymmetrical.

20 f22lpandaninterpretationfunctioni:p!2q,onecanproceedasfollowsin Application Theorem2providesthebasisforourvericationmethodbyusingabstraction. GivenaprogramS=(Q;R),asetPofatomicpropositionsoccurringinformula ordertoverifythatssatisesf,i.e.,jfjs;i=q: (1)GiveanabstractionrelationQQAwhichistotalonQandthecorrespondingabstractionfunction=post[]. (2)ComputetheabstractsystemSandverifywhetherthecharacteristicsetof NoticethatasucientconditionforthisisthatjfjS;I=QAexpressingthat fholdsons.iftheanswerin(2)ispositiveandnoatomicpropositionoccurs negatedinf,thenusingtheorem2.(1b),weobtain (3)SsatisesfwiththeinterpretationfunctioneI,i.e.,jfjS;eI=Q. fons,obtainedusingtheinterpretationfunctioni,iscontainedinthe image(q)ofconcretestates,thatmeanswehavetoverifythat Iffurthermore,I(P)=(eI)(P)foranyP2Pthatoccursinf,then e(jfjs;i)=q. thatthisamountstoevaluateastrongerpropertythanf;therefore,themethod functions(infnegationcanonlybeappliedtoatomicpropositions),wededuce Thismeans(byLemma3)thatinordertoapplythevericationmethodone needstheconsistencyofwithiforallatomicpropositionsoccurringnon negatedinf.forpropositionsp2poccurringonlynegatedinf,computing jfjs;iamountstoevaluatefonswithinterpretatione((i(p)))of:p;as e((i(p)))i(p)isalwaystrueandasalloperatorsinfrepresentmonotonic SsatisesfunderinterpretationI,i.e.,jfjS;I=Q. acounter-example,showingthatoneofthestatesinq0doesnotsatisfyf,orwe havetotrywithamoreprecisesetofabstractstatesandcorrespondingconnection. thatsvh;isa(respectivelysh;isaiffcontainspasttimemodalities). Iftheanswerin(2)isnegative,i.e.,e(jfjS;I)=Q0Q,wecantrytond Obviously,insteadoftheabstractsystemS,wecanuseanysystemSAsuch propositionsoccurringonlynegatedinf. canbeappliedeveniftheconsistencyrequirementidnotfullledforatomic functionsoftheatomicpropositionsiandi.inthatcase,itisshownthatthe fromqtoqasuchthatandearerespectivelyconsistentwiththeinterpretation correspondstoh;i-simulationinducedbyrelationswhicharetotalfunctions Asimilarmethodisappliedin[10].Thenotionofhomomorphismconsideredthere