Abstract State Machines: Verification Problems and Complexity

Abstract State Machines: Verification Problems and Complexity Dissertation Marc Spielmann Rheinisch-Westfälische Technische Hochschule Aachen June 2000 Abstract Abstract state machines (ASMs) provide the formal foundation for a successful methodology for specification and verification of complex dynamic systems. In addition, ASMs induce a computation model on structures, which|in some sense|is more powerful and universal than the standard computation models in theoretical computer science. An investigation of ASMs is therefore interesting from both the point of view of applied computer science and the point of view of theoretical computer science. In the present thesis, practically relevant as well as theoretically motivated questions concerning ASMs are investigated. Subject of the first part of the thesis is the automatic verifiability of ASM specifications. In the second part, the ASM computation model itself and choiceless complexity classes, which have recently been defined by means of ASMs, are discussed. Acknowledgements I would like to thank my advisor, Erich Grädel,for many stimulating discussions, helpful suggestions, and providing direction for my research. Without his advice and support this thesis would not have been possible. A special debt of gratitude I owe to Eric Rosen for numerous conversations on related and unrelated topics and for his countless but futile attempts to improve my English. I am grateful to Jan Van den Bussche for volunteering to review the thesis and for becoming a member of my dissertation committee. Thanks are also due to Andreas Blass and Yuri Gurevich for valuable comments and suggestions concerning the `choiceless' part of this thesis. Contents Introduction 1 Preliminaries 7 Logic . 7 Abstract State Machines . 9 I Automatic Verification 15 1 Verification of Abstract State Machines 17 1.1 The Verification Problem for ASMs . 18 1.2 Sequential Nullary ASMs . 25 1.3 Verifiability Results . 30 2 Verification of Relational Transducers for Electronic Commerce 41 2.1 ASM Relational Transducers . 44 2.2 Verification Problems . 49 2.3 Natural Restrictions . 53 2.4 Verifiability Results . 56 2.5 Proof of Containment . 61 3 Logical Foundation 75 3.1 A Witness-Bounded Fragment of Transitive-Closure Logic . 76 3.2 Existential Transitive-Closure Logic . 83 3.3 Existential Least Fixed-Point Logic . 88 3.4 In the Presence of Function Symbols . 91 4 Discussion 95 II Choiceless Complexity 97 5 Logarithmic-Space Reducibility via Abstract State Machines 99 5.1 Hereditarily Finite Sets as a Domain for Computation . 103 5.2 A Restricted Model . 107 5.3 Bounded-Memory ASMs . 113 5.4 Choiceless Logarithmic Space . 124 6 Logical Descriptions of Choiceless Computations 131 6.1 A Logic for Choiceless Logarithmic Space . 132 6.2 A Logic for Choiceless Polynomial Time . 138 7 Discussion 147 Bibliography 149 Index 154 Introduction Abstract state machines (ASMs, formerly called evolving algebras) [Gur91, Gur95, Gur97b, Gur99] provide the formal foundation for a successful methodology for specification and verification of complex dynamic systems. The design of complex hardware or software systems is typically organized as a series of refinement steps: starting with a high-level description of the system under consideration, one stepwise refines intermediate description stages until a low-level description is obtained. Ideally, the last description stage is close to an actual implementa- tion. The ASM method now proposes to describe each stage of the refinement process in terms of ASMs. The advantage of ASMs is that they are close to logic, which makes the overall design easily amenable to well-understood mathematical techniques. Essentially the mathematical foundation of ASMs supports the formal verification of dynamic systems designed by means of ASMs. For a comprehensive introduction to the ASM method the reader is referred to [Bör99]. Although ASMs can be seen merely as a specification formalism, strictly speaking, ASMs constitute a computation model on structures. The program of an ASM is|like the program of a Turing machine|a description of how to modify the current configuration of a machine in order to obtain a possible succes- sor configuration. The main difference between an ASM and a Turing machine is that the configurations of an ASM are mathematical structures rather than strings. (We view the work tapes of a Turing machine as strings. Notice that strings are particularly simple, one-dimensional structures. Consequently, ev- ery Turing machine can be viewed a particularly simple ASM.) ASMs perform computations on structures in the sense that they obtain a structure as input, modify this structure step by step, and output the resulting structure when reach- ing a halting state. (Aside from this basic model, there exist more general types of ASM, e.g., real-time ASMs and distributed ASMs [BGR95, Gur95, GR00].) The fact that ASMs work on structures rather than strings has important con- sequences: the ASM computation model is, in some sense, more powerful and universal than the standard computation models in theoretical computer science [Gur91, Gur95, Gur99]. In this thesis, we study ASMs from a practical as well as a theoretical perspec- tive. In the first part, we regard the ASM language as a specification formalism that has been proved useful in practice, and investigate the automatic verifiability 1 2 Introduction of dynamic systems formalized in terms of ASMs. In the second part, we consider the ASM computation model itself and discuss choiceless complexity classes defined by means of ASMs. Part I: Automatic Verification The success of the ASM method is witnessed by numerous publications using ASMs for rigorous mathematical correctness proofs of large-scale applications [BH98]. Interestingly, most of the contributions that can be found in the literature focus on manual verification, while the number of contributions where all or part of the verification process is automated is rather small (for exceptions again consult [BH98]). In a nutshell, computer-aided verification of ASMs, i.e., the (semi-) automatic verification of dynamic systems formalized in terms of ASMs, has not yet been well developed. In the first part of the thesis, we investigate the automatic verifiability of ASMs. More precisely, we view the problem of verifying ASMs as a decision problem of the following kind and investigate the decidability of (a yet to be made precise version of) this problem: Given an ASM M and a correctness property ', decide whether M satisfies ' on all inputs. Since ASMs are computationally complete|they can calculate all computable functions|this problem is, in its full generality, undecidable. (It is an easy ex- ercise to define a reduction of the halting problem for Turing machines to the verification problem for ASMs.) Therefore, we examine the decidability of the verification problem with respect to classes of restricted ASMs. That is, we at- tempt to identify conditions on ASMs such that the verification problem becomes decidable for ASMs satisfying these conditions. Once decidability with respect to a class of restricted ASMs is established, all ASMs in this class are automatically verifiable in the sense that there exists a procedure which decides whether a given ASM satisfies a given correctness property on all inputs. Outline of Part I. The first part consists of three chapters, each of which can be read independently. In Chapter 1, we formally define the verification problem for ASMs, present a class of restricted ASMs that can be verified automatically, and show that for straightforward extensions of this class the verification problem becomes undecidable. In Chapter 2, we focus our attention on the automatic verifiability of ASMs specially tailored for electronic commerce applications. All positive verifiability results in the first two chapters are based on reductions to logical decision problems, which are proved decidable in Chapter 3. We conclude our investigation of the automatic verifiability of ASMs with a discussion at the end of Part I. Introduction 3 Part II: Choiceless Complexity The standard computation model in complexity theory is the Turing machine. Of course, there is no problem with this computation model as long as we consider computational problems whose input instances are strings. However, many computational problems arising in computer science and logic have input instances that are naturally viewed as structures rather than strings. For example, consider the problem of evaluating a database query Q, i.e., a mapping from databases to answer relations: given a database , i.e., a finite collection of relations on some finite domain, compute the answerD relation of Q on . The input instances of this problem are databases, which are structures. AtD first glance there is no problem with Turing machines for one can always encode structures as strings and in this way make structures amenable to Turing machines. Unfortunately, this approach has a subtle but important disadvantage: all known string representations of structures generally incorporate superfluous data into the encodings of structures, where by superfluous data we mean data that was originally not contained in the structures (such as a linear order on the universe of a structure). The problem now is that this superfluous data can be retrieved and `misused' by a Turing machine. Here is an example. Fix some standard encoding of databases and consider the class of polynomial- time bounded Turing machines computing mappings from (string representations of) databases to (string representations of) answer relations. In general, this class contains a Turing machine which, on input of a database , computes an answer relation that depends on the string representation of ,D and not necessarily on alone. More to the point, one can find a Turing machineD that computes on twoD different string representations of one and the same database two different, in particular, non-isomorphic, answer relations. The mapping computed by this Turing machine is not considered to be a database query for one is usually not interested in queries whose answer relations depend on the internal representation of databases.

Load more