Checking for Language Inclusion Using Simulation Preorders

Systems involving interaction among state machines, such as protocols, concurrent algorithms, and certain kinds of haxdwarc, often contain subtle design errors that defy detection by conventional means, such as inspection, simulation, and testing a prototype. As a result, formal verification methods for such systems axe of increasing interest. We are interested in a.utoma.tic verification using finite-state models of systems, with the underlying assumption that system behavior can be represented as a set of sequences representing all the possible histories (or traces) of the system (we assume linear-time). In this model, verification consists of testing for languagc inclusion: the implementation describes a set of as traces and the specification gives the set of allowed traces; the implementation meets the specification if every actual trace is allowed. In this paper, we consider only the case where both the implementation and the specification are represented by finite-state automata. The automata used here can describe both safety properties (which intuitively say that nothing bad happens), and liveness properties (which intuitively assert that something good eventually happens). More specifically, we deal with safety automata and Bi'tchi automata. As specifications beconm more complicated, it becomes less natural to express them with deterministic automata. This occurs because a complicated specification is more likely to have invisible internal state that is not a function of the externally visible state. Although such specifications ca~x be expressed using deterministic automata, this places an unnecessary burden on the user. Determinization algorithnls may cause exponential blowups ~'nd a~'e also difficult to program. Deciding language inclusion for non-deterministic automata is PSPACE-complete. Therefore it is highly unlikely that a polynomial technique can be used to decide language inclusion. However, deciding language inclusion tbr deterministic automata is known to be polynomial. Our main goal is to provide polynomial methods that work not only for deterministic automata, but also work for non-deterministic automata in cases of practical interest. The simulation preorder is one of many preorders and equivalences considered by people studying bra~lching-time models of concurrency. Simulation preorder is decidable in polynomial time (proportional to the product of the sizes of the two automata) even when the specification automaton is nondeterministic. However, the simulation preorder is a stronger relation between automata than language inclusion. So from our perspective (linear time), the simulation preorder should be regarded as an al)proximation (sufficient condition) for language inclusion that is much easier to check.