The Spotlight Principle On Combining Process-Summarizing State Abstractions..pdf

The Spotlight Principle ? On Combining Process-Summarizing State Abstractions. Bjo?rn Wachter1 and Bernd Westphal2 1 Universita?t des Saarlandes, Im Stadtwald, 66041 Saarbru?cken, Germany bwachter@cs.uni-sb.de 2 Carl von Ossietzky Universita?t Oldenburg, 26111 Oldenburg, Germany westphal@informatik.uni-oldenburg.de Abstract. Formal verification of safety and liveness properties of sys- tems with a dynamically changing, unbounded number of interlinked processes and infinite-domain local data is challenging due to the two sources of infiniteness. The existing state abstraction-based approaches Data Type Reduction and Environment Abstraction each address one aspect, but the former doesn’t support infinite-domain local data and the latter doesn’t support links and is restricted to particular properties. The contribution of this paper is a combination of both which is obtained by first stating them in the framework of Canonical Abstraction. This new use of Canonical Abstraction, originally designed and used for the analysis of programs with heap-allocated data structures, furthermore unveils a formal connection between the two rather ad-hoc techniques. 1 Introduction A good example for the systems we consider is car platooning as studied in the PATH project [1]. Its objective is to improve highway capacity and fuel consump- tion by having cars dynamically negotiate, via radio-based communication, the formation of platoons in which cars drive with reduced safety distance. A platoon consists of one or more followers and a leader, which is in particular responsible for notifying its followers in advance about braking manoeuvres. Roadside con- trollers announce the maximum platoon length for a certain highway segment and keep track of highway utilisation (cf. Figure 1(a)). A formal model of the snapshot of car-platooning shown in Figure 1(a) is depicted in Figure 1(b). There, each car has a local state, like being a follower (‘flw ’) or leader (‘ldr ’), and a finite-domain v