Section: Scientific Foundations

Models and Verification Techniques

By verification, we mean comparison — at some abstraction level — of a complex system against a set of properties characterizing the intended functioning of the system (for instance, deadlock freedom, mutual exclusion, fairness, etc.).

Most of the verification algorithms we develop are based on the labeled transition systems (or, simply, automata or graphs) model, which consists of a set of states, an initial state, and a transition relation between states. This model is often generated automatically from high-level descriptions of the system under study, then compared against the system properties using various decision procedures. Depending on the formalism used to express the properties, two approaches are possible:

• Behavioral properties express the intended functioning of the system in the form of automata (or higher level descriptions, which are then translated into automata). In this case, the natural approach to verification is equivalence checking, which consists in comparing the system model and its properties (both represented as automata) modulo some equivalence or preorder relation. We develop equivalence checking tools that compare and minimize automata modulo various equivalence and preorder relations; some of these tools also apply to stochastic and probabilistic models (such as Markov chains).

• Logical properties express the intended functioning of the system in the form of temporal logic formulas. In this case, the natural approach to verification is model checking, which consists in deciding whether or not the system model satisfies the logical properties. We develop model checking tools for a powerful form of temporal logic, the modal $\mu$-calculus, which we extend with typed variables and expressions so as to express predicates over the data contained in the model. This extension (the practical usefulness of which has been highlighted in many examples) provides for properties that could not be expressed in the standard $\mu$-calculus (for instance, the fact that the value of a given variable is always increasing along any execution path).

Although these techniques are efficient and automated, their main limitation is the state explosion problem, which occurs when models are too large to fit in computer memory. We provide software technologies (see §  5.1 ) for handling models in two complementary ways:

• Small models can be represented explicitly, by storing all their states and transitions in memory (exhaustive verification).

• Larger models are represented implicitly, by exploring only the model states and transitions needed for the verification (on the fly verification).