## Section: New Results

Keywords : Reachability Analysis, Abstract Interpretation, Communicating Finite State Machines, FIFO channels, theorem proving, rewriting logic.

### Verification and Abstract Interpretation

#### Verification of Communication Protocols using Abstract Interpretation of FIFO queues

Participant : Tristan Le Gall.

The PhD thesis of Tristan Le Gall, co-supervised by Bertrand Jeannet (Pop-Art project team) is concerned by the verification of asynchronous systems communicating through FIFO channels and its applications. Communication protocols can be formally described by the Communicating Finite-State Machines (CFSM) model. This model is expressive, but not expressive enough to deal with complex protocols that involve structured messages encapsulating integers or lists of integers. That is the reason why we studied, this year, more complex models with an infinite alphabet of messages. We thus propose a new abstract domain for languages on infinite alphabets, which acts as a functor taking an abstract domain for a concrete alphabet and lift it to an abstract domain for words on this alphabet. The abstract representation is based on lattice automata, which are finite automata labeled by elements of an atomic lattice. We define a normal form, standard language operations and a widening operator for these automata. We apply this abstract lattice for the verification of symbolic communicating machines, and we discuss its usefulness for interprocedural analysis [Oops!] , [Oops!] .

#### Theorem proving for rewriting logic

Participant : Vlad Rusu.

This is common work with Manuel Clavel from the University of Madrid. In [Oops!] we present an approach based on inductive theorem proving for verifying invariance properties of systems specified in Rewriting Logic ( rl ) [42] , an executable specification language implemented, among others, in the Maude tool [32] . Since theorem proving is not directly available for rewriting logic, we define an encoding of rewriting logic into its Membership Equational (sub)Logic ( mel ) [43] . Then, inductive theorem provers for mel , such as the itp tool [33] , can be used for verifying the resulting membership equational logic specification, and, implicitly, for verifying the original rl specification. The approach is illustrated on the 2-process Bakery algorithm and also on the parametric, n -process version of the algorithm.

#### Probabilistic and Topological Semantics for Timed Automata

Participant : Nathalie Bertrand.

Like most models used in model-checking, timed automata are an idealized mathematical model used for representing systems with strong timing requirements. In such mathematical models, properties can be violated, due to unlikely (sequences of) events. In [Oops!] , we propose two new semantics for the satisfaction of LTL formulas, one based on probabilities, and the other one based on topology, to rule out these sequences. We prove that the two semantics are equivalent and lead to a PSPACE-Complete model-checking problem for LTL over finite executions.