Construction of Abstract State Graphs with PVS Susanne Graf and Hassen Saidi VERIMAG

Summary of the Paper Method based on abstract interpretation –a weaker abstract transition relation –automatically construct an abstract state graph –input: infinite state program Monomials: particular set of abstract states –defined w.r.t. a set of state predicates  1...  k Successor states: computed by using PVS –upper approximation of the successor states Construct abstract state graph –verify invariants –LTL prop. by MC

Summary of the Paper (2) Abstract State Graph: –represents a relatively precise global control flow graph of the system –can be used to generate stronger structural invariants –assumes that control depends on data Implemented the method in a tool: –interfaced with PVS, ALDÉBARAN Verified bounded retransmission protocol: –protocol developed by Philips –used the tool to prove correctness almost automatically

Parallel Systems: Syntax Basic intuition: parallel composition of processes by interleaving and synchronization by shared variables (unity) Process: process P is varsx 1 :T 1,..., x n :T n → global, what P uses initinit_pred(x 1,..., x n )→ implicit pc (control var) update □ g 1 (x) → ass 1 (x)-  1 □ g n (x) → ass n (x)-  n Parallel composition (P 1 || P 2 ): is a process P s.t. P_init = P 1 _init  P 2 _init P_vars = P 1 _vars  P 2 _vars P_upd = P 1 _upd  P 2 _upd Type - might be infinite (PVS type)

Transition Graph for P Given is P (vars, init, update) Define the transition graph S P = (Q P, R P, I P ) Q P = T 1 x... x T n R P = U  i where  i (q) = I P = {q | init(q) = true} R P : Q P → P(Q P ) ≡ R P  Q P x Q P i=1 P  if g i (q) = false ass i (q) otherwise

Predicate Transformers Definition: R  Q x Q and   P(Q) {  } g → ass {  } strongest postcondition:post[R](  ) =  q. R(q,q')   (q) weakest precondition:pre[R](  ) =  q'. R(q,q')   (q') R(q, q 1 )   (q 1 ) ... R(q, q n )   (q n ) property:  = post[R](  )   = pre[R](  ) preconditionpostcondition set of guarded assignments ass(q) pre[  i ](  ) = g i (x)   [ass i (x) / x]  no quantifiers