LinearTime Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute  G N Chetty Road Madras   India Email madhavanssf

LinearTime Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute G N Chetty Road Madras India Email madhavanssf - Description

ernetin Abstract Over the past two decades temporal logic has become a very ba sic tool for spec ifying properties of reactive systems For 64257nitestate sys tems it is possible to use techniques based on B57512uchi automata to verify if a system mee ID: 22330 Download Pdf

144K - views

LinearTime Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute G N Chetty Road Madras India Email madhavanssf

ernetin Abstract Over the past two decades temporal logic has become a very ba sic tool for spec ifying properties of reactive systems For 64257nitestate sys tems it is possible to use techniques based on B57512uchi automata to verify if a system mee

Similar presentations


Download Pdf

LinearTime Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute G N Chetty Road Madras India Email madhavanssf




Download Pdf - The PPT/PDF document "LinearTime Temporal Logic and Buchi Auto..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.



Presentation on theme: "LinearTime Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute G N Chetty Road Madras India Email madhavanssf"— Presentation transcript:


Page 1
Linear-Time Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute 92 G N Chetty Road Madras 600 017, India E-mail: madhavan@ssf.ernet.in Abstract Over the past two decades, temporal logic has become a very ba sic tool for spec- ifying properties of reactive systems. For finite-state sys tems, it is possible to use techniques based on Buchi automata to verify if a system mee ts its specifications. This is done by synthesizing an automaton which generates al l possible models of the given specification and then verifying

if the given syste m refines this most gen- eral automaton. In these notes, we present a self-contained introduction to the basic techniques used for this automated verification. We also des cribe some recent space- efficient techniques which work on-the-fly.
Page 2
M Mukund: LTL and Buchi Automata Introduction Program verification is a fundamental area of study in comput er science. The broad goal is to verify whether a program is “correct”—i.e., whether th e implementation of a program meets its specification. This is, in general, too

ambitious a goal and several assumptions have to be made in order to render the problem tractable. In th ese lectures, we will focus on the verification of finite-state reactive programs . For specifying properties of programs, we use linear time temporal logic. What is a reactive program? The general pattern along which a conventional program executes is the following: it accepts an input, performs som e computation, and yields an output. Thus, such a program can be viewed as an abstract func tion from an input domain to an output domain whose behaviour consists of a transforma

tion from initial states to final states. In contrast, a reactive program is not expected to terminate . As the name suggests, such systems “react” to their environment on a continuous basis, responding appropriately to each input. Examples of such systems include operating syst ems, schedulers, discrete-event controllers etc. (Often, reactive systems are complex dist ributed programs, so concurrency also has to be taken into account. We will not stress on this as pect in these lectures—we take the view that a run of a distributed system can be represe nted as a sequence, by arbitrarily

interleaving concurrent actions.) To specify the behaviour of a reactive system, we need a mecha nism for talking about the way the system evolves along potentially infinite comput ations. Temporal logic [Pnu77] has become a well-established formalism for this purpose. M any varieties of temporal logic have been defined in the past twenty years—we focus on proposi tional linear time temporal logic (LTL). There is an intimate connection between models of LTL formul as and languages of infinite words—the models of an LTL formula constitute an -regular language over an

appropriate alphabet. As a result, the satisfiability probl em for LTL reduces to checking for emptiness of -regular languages. This connection was first explicitly po inted out in [SVW87]. Later, in [VW86], the connection between LTL and -regular languages has been ex- tended to model checking . Unlike the satisfiability problem, which asks if a given for mula has a model, the model-checking problem is one of verificatio n: the task is to verify whether a given finite-state program satisfies a specification . This consists of checking that all runs of

constitute models for . Since finite-state reactive programs can be represented quite naturally as Buchi automata, model-che cking also reduces to a problem in automata theory. It suffices to show that no run of is a model for , which is the same as checking that the intersection of the language accep ted by and the language defined by is empty. In recent years, the techniques proposed in [VW86] have move d from the realm of theory to practice. In this context, there has been renewed e mphasis on reducing the complexity of the automata-theoretic method. One fruitful

approach is to build up the automaton associated with a formula “on-the-fly” so that onl y as much of the automaton Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 3
M Mukund: LTL and Buchi Automata is constructed as is needed to settle the model-checking pro blem. A first step in this regard is the algorithm proposed in [GPVW95]. This write-up is organized as follows. We begin with a descri ption of the logical language LTL. We then provide a quick introduction to Buchi automata in Section 2. In Section 3 we describe the

basic automata-theoretic approach of [VW86]. Next, in Section 4, we present a formal basis for the on-the-fly method of [GPVW95]. We concl ude with some pointers to ways in which these approaches can be extended in more gene ral settings. 1 Linear-time temporal logic Linear time temporal logic is a logic for talking about infini te sequences, where each element in the sequence corresponds to a propositional world. Syntax We fix a countable set of atomic propositions , p , . . . . Then Φ, the set of formulas of LTL, is defined inductively as follows: Every member of

belongs to Φ. If and are formulas in Φ, then so are O and The connectives and correspond to the usual Boolean connectives “not” and “or respectively. The modality to be read as “next” while the binary modality is to be read as “until”. Thus O is “next ” while is until ”. Semantics model is a function . In other words, a model is an infinite sequence . . . of subsets of . The function describes how the truth of atomic propositions changes as time progresses. We write M, i to denote that is true at time instant in the model ”. This notion is defined inductively, according

to the structure of M, i , where ∈ P , i ). M, i i M, i 6| M, i i M, i or M, i M, i O i M, i +1 M, i iff there exists such that M, k and for all such that j < k M, j Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 4
M Mukund: LTL and Buchi Automata A formula is said to be satisfiable if there exists a model and an instant such that M, i . Since the modalities we have defined only talk about future t ime-points within a model, it is not difficult to argue that a formula is satisfiable iff in some model it

is satisfied at the initial point. Proposition 1.1 Let be a formula in . Then is satisfiable iff there exists a model such that M, Another simple observation is that in order to satisfy a form ula , a model needs to assign truth values only to those propositions which occur in . Let Voc( ), the “vocabulary of , denote the subset of which is mentioned in . Voc( ) can be defined inductively quite easily: Voc( ) = Voc( ) = Voc( Voc( ) = Voc( Voc( Voc( O ) = Voc( Voc( ) = Voc( Voc( If is a model and is a formula, let Voc( be a new model where for all Voc( ) = Voc( ). We

then have the following simple fact. Proposition 1.2 Let be a model and be a formula. Then, for all M, i i Voc( , i Derived connectives As usual, we introduce constants and representing “true” and “false”. We can write as, for instance, (recall that , p , . . . ) and as > We can also generate normal Boolean connectives like (“and”), (“implies”) and (“iff”) from the connectives and in the usual way—for instance, We also introduce two derived modalities based on . We write for >U and for . The modality is read as “eventually” while the modality is read as “henceforth”. Let be a

model. It is not difficult to verify the following facts: M, i iff there exists such that M, k M, i iff for all M, k Examples Here are some examples of the kinds of assertions we can make i n temporal logic. The formula 32 says that is eventually a “stable property” of the system M, i 32 iff for some , for all M, k Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 5
M Mukund: LTL and Buchi Automata On the other hand, 23 asserts that holds infinitely often. If we use the full power of , we can make some fairly complex

statements about a program’s behaviour. For instance, consider a system whic h schedules access to a shared resource among competing processes which are named, for convenience, , . . ., k . For each process , we could have two atomic propositions and to denote the state of vis-a-vis the shared resource—proposition is true if process has requested the resource but has not yet got access to it, while is true when is granted access to the resource. The formula asserts that process continues to be in a requesting state until access to the resource is granted. A desirable property that the system

should satisfy is that for all , the formula )) is true at the initial state—i.e., the scheduler eventually grants every request. For a detailed exposition of how to specify properties of rea ctive systems in temporal logic, the reader is referred to the book [MP91]. 2 Buchi automata Automata on infinite inputs were introduced by Buchi in [Bu 60]. A Buchi automaton is a non-deterministic finite-state automaton which takes in nite words as input. A word is accepted if the automaton goes through some designated “g ood” states infinitely often

while reading it. We begin with some notation for infinite words. Let Σ be a finite alphabet. An infinite word is an infinite sequence of symbols from Σ. We shall represent as a function Σ, where is the set , . . . of natural numbers. Thus, ) denotes the letter occurring at the th position. In general, if is a set and an infinite sequence of symbols over —in other words, —then inf ) denotes the set of symbols from which occur infinitely often in . Formally, inf ) = | ) = , where denotes the quantifier “there exist infinitely many”.

Automata An automaton is a triple = ( S, , S in ) where is a set of states in is a set of initial states and is a transition relation . Normally, we write to denote that ( s, a, s The automaton is said to be deterministic if in is a singleton and is a function from Σ to . The automata we encounter in this paper will, in general, be non-deterministic. Runs Let = ( S, , S in ) be an automaton and Σ an input word. A run of on is a infinite sequence such that (0) in and for all +1). Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 6
M Mukund:

LTL and Buchi Automata Figure 1: A typical accepting run of a Buchi automaton, with in and So, a run is just a “legal” sequence of states that an automato n can pass through while reading the input. In general, an input may admit many r uns because of non- determinism. Since a non-deterministic automaton may have states where there are no outgoing transitions corresponding to certain input lette rs, it is also possible that an input admits no runs—in this case, every potential run leads to a state from w here there is no outgoing transition enabled for the next input letter. If

th e automaton is deterministic, each input admits precisely one run. Buchi automata Buchi automaton is a pair ( , G ) where = ( S, , S in ) and denotes a set of good states . The automaton ( , G accepts an input Σ if there is a run of on such that inf . The language recognized by , G ), , G ), is the set of all infinite words accepted by ( , G ). A set is said to be Buchi-recognizable if there is a Buchi automaton ( , G ) such that , G ). According to the definition, a Buchi automaton accepts an in put if there is a run along which some

subset of occurs infinitely often. Since is a finite set, it is easy to see that there must actually be a state which occurs infinitely often along . In other words, if we regard the state space of a Buchi automaton as a g raph, an accepting run traces an infinite path which starts at some state in in , reaches a good state and, thereafter, keeps looping back to infinitely often (see Figure 1). Example 2.1 Consider the alphabet Σ = a, b . Let consist of all infinite words such that there are infinitely many occurrences of in . Figure 2

shows a Buchi automaton recognizing . The initial state is marked by an unlabelled incoming arrow There is only one good state, which is indicated with a double circle. In this automaton, all transitions labelled lead into the good state and, conversely, all transitions co ming into the good state are labelled . From this, it follows that the automaton accepts an infinite word iff it has infinitely many occurrences of The complement of , which we denote , is the set of all infinite words such that has only finitely many occurrences of . An automaton

recognizing is shown in Figure 3. The automaton guesses a point in the input beyond which it wil l see no more ’s—such a point must exist in any input with only a finite number of ’s. Once it has made this guess, it can process only ’s—there is no transition labelled from the second state—so if it reads any more ’s it gets stuck. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 7
M Mukund: LTL and Buchi Automata Figure 2: A Buchi automaton for (Example 2.1) a, b Figure 3: A Buchi automaton for (Example 2.1) In the example,

notice that the automaton recognizing is deterministic while the au- tomaton for is non-deterministic. It can be shown that the non-determin ism in the second case is unavoidable—that is, there is no deterministic automaton recognizing This means that Buchi automata are fundamentally different from their counterparts on finite inputs: we know that over finite words, deterministic a utomata are as powerful as non-deterministic automata. 2.1 Constructions on Buchi automata It turns out that the class of Buchi-recognizable language s is closed under

boolean opera- tions. Union To show closure under finite union, let ( , G ) and ( , G ) be two Buchi au- tomata. To construct an automaton ( , G ) such that , G ) = , G , G ), we take to be the disjoint union of and . Since we are permitted to have a set of initial states in , we retain the initial states from both copies. If a run of starts in an initial state contributed by , it will never cross over into the state space contributed by and vice versa. Thus, we can set the good states of to be the union of the good states contributed by both components. Complementation Showing

that Buchi-recognizable languages are closed und er com- plementation is highly non-trivial. One problem is that we c annot determinize Buchi automata. Even if we could work with deterministic automata , the formulation of Buchi Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 8
M Mukund: LTL and Buchi Automata acceptance is not symmetric with respect to complementatio n in the following sense. Sup- pose ( , G ) is a deterministic Buchi automaton and is an infinite word which does not belong to , G ). Then,

the (unique) run of on is such that inf( . Let denote the complement of . It follows that inf( , since some state must occur infinitely often in . It would be tempting to believe that the automaton ( recognizes , G ). However, there may be words which admit runs which visit bo th and infinitely often. These words will be including both in ) as well as in , G ). So, there is no convenient way to express the complement of a Buchi condition again as a Buchi condition. Fortunately, we shall not need t o complement Buchi automata for any of the constructions

which we describe here. Intersection Turning to intersection, the natural way to intersect autom ata and is to construct an automaton whose state space is the cross pr oduct of the state spaces of and and let both copies process the input simultaneously. For fin ite words, the input is accepted if each copy can generate a run which reache s a final state at the end of the word. For infinite inputs, we have to do a more sophisticated produc t construction. An infinite input should be accepted by the product system provided both copie s generate runs which visit good

states infinitely often. Unfortunatel y, there is no guarantee that these runs will ever visit good states simultaneously—for i nstance, it could be that the first run goes through a good state after (0), (2), ...while the second run enters good states after (1), (3), ... So, the main question is one of identifying the good s tates of the product system. The key observation is that to detect that both components of the product visit good states infinitely often, one need not record every point where the copies visit good states; in each copy, it suffices to observe an

infinite subsequence of t he overall sequence of good states. So, we begin by focusing on the first copy and waiting f or its run to enter a good state. When this happens, we switch attention to the other co py and wait for a good state there. Once the second copy reaches a good state, we switch ba ck to the first copy and so on. Clearly, we will switch back and forth infinitely often iff both copies visit their respective good states infinitely often. Thus, we can charac terize the good states of the product in terms of the states where one switches back

and for th. Formally, the construction is as follows. Let ( , G ) and ( , G ) be two Buchi au- tomata such that = ( , S in ) for = 1 2. Define ( , G ), where = ( S, , S in ), as follows:  { The transition relation is defined as follows: , s 1) , s 1) if and , s 1) , s 2) if and , s 2) , s 2) if and Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 9
M Mukund: LTL and Buchi Automata , s 2) , s 1) if and in , s 1) in and in  { In the automaton , each product state carries an extra tag indicating whether the au-

tomaton is checking for a good state on the first or the second c omponent. The automaton accepts if it switches focus from the second component to the first infinitely often. (Notice that we could equivalently have defined to be the set  { .) It is not difficult to verify that , G ) = , G , G ). Emptiness In applications, we will need to be able to check whether the l anguage ac- cepted by a Buchi automaton is empty. To do this, we recall ou r observation that any accepting run of a Buchi automaton must begin in an initial s tate, reach a

final state and then cycle back to infinitely often. If we ignore the labels on the transitions, we can regard the s tate space of a Buchi automaton ( , G ) as a directed graph = ( , E ) where and ( s, s i for some Σ, . Recall that a set of vertices in a directed graph is a strongly connected component iff for every pair of vertices v, v , there is a path from to Clearly, , G ) is non-empty iff there is a strongly connected component in such that contains a vertex from and is reachable from one of the initial states. We thus have the following theorem.

Theorem 2.2 The emptiness problem for Buchi automata is decidable. Notice that it is sufficient to analyze maximal strongly connected components in in order to check that , G . Computing the maximal strongly connected components of a directed graph can be done in time linear in the size of the graph [AHU74], where the size of a graph = ( V, E ) is, as usual, given by . Checking reachability can also be done in linear time. So, if has states, checking that , G can be done in time ). 2.2 Generalized Buchi automata When expressing the connection between temporal logic and B

uchi automata, it is often convenient to work with a slightly more elaborate acceptanc e condition. A generalized Buchi automaton is a structure ( , G , G , . . ., G ), where = ( S, , S in ) and for all ∈ { , . . ., k An input is accepted by the automaton ( , G , G , . . ., G ) if there is a run of on such that inf for all ∈ { , . . ., k . As usual, , G , G , . . ., G denotes the language of all infinite words accepted by the aut omaton ( , G , G , . . ., G ). The following observation is immediate. Winter School on Logic & Computer Science ISI Calcutta, Dec

1996–Jan 1997
Page 10
M Mukund: LTL and Buchi Automata Proposition 2.3 Let , G , G , . . ., G be a generalized Buchi automaton. Then , G , G , . . ., G ) = ∈{ ,...,k , G In other words, every language which is recognized by a gener alized Buchi automaton is also Buchi recognizable. It is not difficult to argue that che cking whether the language accepted by a generalized Buchi automaton is empty is no har der, in terms of computational complexity, than the corresponding check for a normal Buch i automaton. Further reading The

languages recognized by Buchi automata correspond to -regular languges. These languages have a syntactic characterization in terms of reg ular languages of finite strings. They can also be characterized logically using the monadic s econd order theory of one successor (S1S). For a more detailed introduction to the the ory of automata on infinite words, the reader is encouraged to consult the excellent sur veys by Thomas [Th90, Th96]. 3 Automata-theoretic methods As we saw in the last section, a model for an LTL formula is a function We also saw that to check whether is

satisfiable, it suffices to look at models defined over Voc( ). In other words, we can restrict our attention to models of t he form . . . where each is a subset of Voc( ). Since Voc( ) is finite, we can treat each model as an infinite word over the finite alphabet 2 Voc( The result we shall establish is that the set of all infinite wo rds over 2 Voc( which are models for —i.e., the set Mod( ) = . . . M, actually constitutes a Buchi recognizable language. We sh all also demonstrate how to explicit construct a generalized Buchi automaton

( , G , G , . . ., G ) over the alphabet Voc( such that , G , G , . . ., G ) = Mod( ). 3.1 Satisfiability We begin by defining the (Fischer-Ladner) closure of a formul a. Closure Let be an LTL formula. Then CL ) is the smallest set of formulas such that: CL ). If CL ), then CL ). Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 11
M Mukund: LTL and Buchi Automata 10 If CL ), then β, CL ). If O CL ), then CL ). If CL ), then β, γ, O CL ). Finally, CL( ) = CL ∪ { CL , where we identify with Notice that CL( ) is

always finite, even though the clause for throws in a larger formula into the set. In fact, if contains symbols, then CL( is ). The automaton that we associate with a formula will have as its states subsets of CL( ) which are both propositionally and temporally “consisten t”. These subsets are called atoms. Atoms Let be a formula. Then CL( ) is an atom if: CL( ), i β / CL( ), i or CL( ), i or β, O Let AT be the set of all atoms of Constructing a Buchi automaton for We first construct an automaton = ( S, , S in ) over the alphabet 2 Voc( , where: AT Let A, B

∈ AT and Voc( ). Then iff the following hold. Voc( ). For all O CL( ), O i in ∈ AT | Let , , . . ., be the set of until formulas which appear in CL( ). We add a generalized Buchi acceptance condition ( , G , . . ., G ) where for each ∈ AT | or We then have the following theorem. Theorem 3.1 Let be an infinite word over Voc( . Then , G , G , . . ., G i M, Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 12
M Mukund: LTL and Buchi Automata 11 Proof ) Let . . . be an infinite word over Voc( ) which is

accepted by , G , G , . . ., G ). Let . . . be an accepting run of on . For all CL( and for all , we show that M, i i The proof is by induction on the structure of ∈ P Then M, i i i Then M, i i M, i 6| iff (by the induction hypothesis) γ / i (by the definition of an atom). Then M, i iff ( M, i or M, i ) iff—by the induction hypothesis—( or ) iff—by the definition of an atom O Then M, i i M, i +1 iff (by the induction hypothesis) +1 iff (by the definition of +1 O Suppose that M, i . We must show that . By the semantics of the

modality , there exists such that M, k and for all j < k M, j . We show that by a second induction on Base case: = 0) Then and M, i . By the main induction hypothesis, , whence, from the definition of atoms, Induction step: ` > 0) By the semantics of the modality M, i and M, i +1 . Then, by the secondary induction hypothesis, +1 . From the definition of +1 , we then have (recall that if CL( ) then CL( ) as well). By the main induction hypothesis, we also have . Combining these facts, from the definition of an atom, Conversely, suppose . We must show that M, i . Recall that we

have indexed the until formulas in CL( ) by 1 , . . ., k . Let be the index of Since . . . is an accepting run of ( , G , G , . . ., G ), there must exist a such that . Choose the least such . Once again, we do a second induction on to show that M, i Base case: = 0) If , then . Since , the only way for to be in is for to also belong to . Then, by the main induction hypothesis, M, i , whereby M, i as well. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 13
M Mukund: LTL and Buchi Automata 12 Induction step: ` > 0) Since δ / . From the

definition of atoms, both and ) must be in . Since +1 , it must be the case that and +1 . By the secondary induction hypothesis, M, i +1 while by the main induction hypothesis M, i . From the semantics of the modality , it then follows that M, i as well. ) Suppose that . . . such that M, . We have to show that , G , G , . . ., G ). In other words, we have to exhibit an accepting run of the au toma- ton on For , define to be the set CL( M, i . It is easy to verify that each is an atom. We can also verify that each adjacent pair of atoms and +1 satisfy the conditions specified

for the existence of an arrow +1 . Finally, since M, we have , so is an initial state in . From all this, it follows that . . . is a run of the automaton on To check that it is an accepting run, we have to verify that eac h good set is met infinitely often. Suppose this is not the case—i.e., for some and some index for all . In other words, for all , the th until formula in CL( ), , belongs to and . Since CL( M, k , it follows that M, k . But, since for all , it follows that M, j for all which contradicts the fact that M, k It follows from the preceding theorem that is satisfiable

iff the language recognized by , G , G , . . ., G ) is non-empty. Let the length of be . Since the size of CL( ) is linear in , it follows that the number of states in is bounded by 2 . Since checking for non-emptiness can be done in time (2 = 2 , the satisifiability problem for a formula of length is solvable in time 2 3.2 Model checking Let us model finite-state reactive programs as (generalized ) Buchi automata—a program is a structure = (( S, , S in , G , G , . . ., G ). The acceptance condition may trivial—i.e., we could have = 1 and We use atomic propositions to

characterize properties sati sified by the states of the program. In other words, a program comes with a function → P which describes the properties of each state. Each run of generates a model in the obvious way. Let . . . be a run of —in other words, in and for all +1 . This induces a model → P given by ) = )) for all The model-checking problem is the following: given a progra and a valuation together with a specification , does every run of satisfy ? In other words, we want to check that the set Mod( ) = is a run of is a subset of Mod( ), the set of models of . This

is equivalent to saying that Mod( ) does not contain any model of Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 14
M Mukund: LTL and Buchi Automata 13 To check this, we first construct an automaton ( , G , G , . . ., G ) from ( P, V ) over the alphabet 2 Voc( as follows. Let = (( S, , S in , G , G , . . ., G ). Then , S in ), where s, Q, s | a. s and Voc( in in The following is then obvious: Theorem 3.2 Let P, V be a program and be a formula. Then all models generated by satisfy i ) = Recall that intersecting two Buchi automata

is just a simpl e extension of the product construction. From this it follows that the complexity of se ttling the model checking problem is ), where is the the number of states in and is the length of 4 On-the-fly methods The construction described in the previous section require s us to construct the entire automaton in order to solve the model-checking problem. In particular , the emptiness check at the end of the procedure assumes that the entire auto maton is available in memory in order to search for an accepting run. A simple way to get around this memory requirement is to explo

re the state space in an incremental fashion. For instance, in [CVWY92], a dept h-first-search (DFS) based strategy is used to detect cycles and hence check for emptine ss, rather than looking for strongly connected components directly in the full automat on graph. Such a strategy can be implemented along with an “on-the-fly construction of the automaton—when constructing the product of the program aut omaton and the formula automaton, we generate the states of the product incrementa lly, as and when they are explored by the DFS-based cycle-detection strategy. In the process, if we

find an accepting cycle, we can abort the search without generating the entire state space. Of course, in the worst case (which occurs when the program does meet the specification given the formula!), we end up having to explore the entire state space. To generate the product state space on the fly, we have to first h ave a method for constructing both the program automaton and formula automa ton on-the-fly, individually. In many applications, the program to be verified is a concurre nt system specified in terms of its components. In order to apply the

technique disc ussed in the previous section, we have to generate the global state space of the concurrent p rogram. The obvious on-the- fly approach is to generate these global states as and when the need arises. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 15
M Mukund: LTL and Buchi Automata 14 More tricky is to find an on-the-fly approach for generating th e formula automaton. A procedure for achieving this is described in [GPVW95]. How ever, the construction presented in [GPVW95] is fairly opaque thanks to the fact tha t

it blurs the distinction between the basic strategy used for on-the-fly generation an d some specific optimizations which improve the overall performance. Here, we present the basis a technically cleaner version of t he [GPVW95] algorithm (which is admittedly less efficient overall). However, by sep arately applying optimizations to our construction, we can improve the complexity bounds. T he construction described here is from [DSz96]. Now and next-state requirements Though LTL formulas are intepreted on infinite runs, the defin ition of the satisfaction relation

for LTL gives rise to what may be called a “two-state ” semantics. Every LTL formula can be thought of as specifying two sets of requirements: one set to be satisfied “now” and the rest to be satisfied in the “next state”. For inst ance, the formula says that either is true now, or is true now and is true in the next state. By repeatedly breaking down a formula, we can put it in a sort o f disjunctive normal form, which specifies all possible ways of making the formula true. For instance, the formula ) breaks down into two sets of requirements, p, q, O and p, r . If either of

these sets is true, the original formula is true. Notice th at each of these sets internally breaks up into current requirements (e.g., p, q in the first set) and next-state requirements ) in the first set). We would like to formalize this notion: a formula will genera te an automaton whose states are sets like the ones above. Each set represents one w ay of making some requirement true. A state is a valid next state for a state if it is one of the ways of satisfying the next-state formulas in Positive formulas We modify the syntax of LTL so that all negations appear only a t the

level of atomic propositions. Formally, we begin with a set of atomic propos itions , together with pre- defined constants and . Let denote the set { ∈ P} . Then , the set of LTL formulas in positive form , is defined inductively as follows: • > and belong to Every member of and belongs to If and are formulas in , then so are O and The semantics is , O and is as before. The formula is an abbreviation for U ). It is easy to check that Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 16
M Mukund: LTL and Buchi Automata 15 M, i

iff either for all M, k or there is a such that M, j and for all M, ` Notice that any LTL formula can be converted into a positive f ormula by pushing all negations inwards to the level of atomic propositions. The r esulting formula may be longer, but is still linear in the size of the original formula. Hence forth, we assume that all formulas we encounter are from For a set of formulas , let next ) = O O and snext ) = O In other words, snext ) consists of all -formulas in stripped of the modality. We use to denote the conjunction of formulas in and to denote the disjunction of formulas

in . We adopt the convention that and Disjunctive normal form To formalize the notion of breaking down a formula into all possible ways of satisfying it, we introduce a version of dis junctive normal form. Let dnf : Sets of subsets of P P next ( be given by: dnf ) = {∅} dnf ) = dnf ) = {{ }} for p, p, O dnf ) = dnf dnf dnf ) = dnf , D dnf , C is propositionally consistent dnf ) = dnf )) dnf dnf ) = dnf dnf )) Thus the function dnf breaks up a formula into a set of sets of formulas. Each lower level set represents a clause in an extended version of disju nctive normal form, where

propositions, their negations and next formulas are treate d as literals. The modalities and are interpreted as disjunctions over their “two-state sema ntics”. We can prove the following by induction on the structure of fo rmulas. Lemma 4.1 For all formulas dnf Let us fix a formula . We extend the notion of CL( ) to cover the new modality in the obvious way: if CL( ), then β, CL( ). In our on-the-fly construction, we will not work with fully sp ecified atoms. Instead, we normally work with “unsaturated” subsets CL( ). For such a subset , we define consq ), the

logical consequences of as follows. Let CL( ). Then consq ) is the smallest subset of CL( ) such that: Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 17
M Mukund: LTL and Buchi Automata 16 consq If > CL( ) then > consq ). For all CL( ), if consq ) or consq ) then consq ). For all CL( ), if β, consq ) then consq ). For all CL( ), if β, O consq ) or consq ) then consq ). For all CL( ), if β, consq ) or β, O consq ) then consq ). The following properties of consq are not difficult to prove. Lemma 4.2 Let CL and X, Y CL .

Then (i) If then consq consq (ii) If dnf then consq (iii) If and dnf , then consq (iv) Let . . . be a model. If M, then M, consq We can now define a generalized Buchi automaton correspondi ng to a formula . The automaton = ( S, , S in ) over 2 Voc( is given by: = Subsets of P P next (CL( )). in dnf ). iff the following are true: ∩ P | } dnf snext )). Notice that we could now have many different arrows between a pair of states and , since and are no longer atoms. In general, a labelled-arrow exists provided does not contradict the propositional assertions in As

before let , , . . ., be the set of until formulas which appear in CL( ). We add a generalized Buchi acceptance condition ( , G , . . ., G ) where for each consq ) or consq We want to show that . . . is accepted by ( , G , G , . . ., G ) i M, We break the proof up into two parts. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 18
M Mukund: LTL and Buchi Automata 17 Soundness Let . . . be accepted by ( , G , G , . . ., G ). We need to show that M, Let . . . be an accepting run for . We show the following: Lemma 4.3 CL , if consq then M, i

Proof By induction on the structure of ∈ P If consq ) then which implies that which implies that M, i p, p ∈ P If consq ) then which implies that p / which implies that M, i Since consists of formulas from P P next ( ), it cannot be the case that . Thus, we must have derived the fact that consq ) using our inductive definition of consq ). From this, it follows that either consq or consq ). By the induction hypothesis, either M, i or M, i , so M, i Once again, it cannot be the case that . From the fact that consq ), it follows that consq ) and consq ). By the induction

hypothesis, M, i and M, i , so M, i O If O consq ) then O . So snext ). Since +1 dnf snext )), it follows from Lemma 4.2 (ii) that consq +1 ). By the induction hypothesis, M, i +1 , so M, i O In general if and consq ), then either consq ) or consq ) and consq ). So, if consq ), it follows either that for all consq ) and δ / consq ) or that there exists such that consq ) and for all such that j < k consq ). The first case is ruled out by the fact that . . . is an accepting run. By the induction hypothesis, the second case yields M, k and M, j whereby M, i In general if and consq ),

then either consq ) or consq ) and consq ). It follows that either for all consq Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 19
M Mukund: LTL and Buchi Automata 18 and consq ) or there exists such that consq ) and for all such that j < k consq ). If the first case holds, by the induction hypothesis, we have M, k for all so M, i by the semantics of the modality . If the second case holds, from the definition of consq , it follows that γ, consq ). Hence, by the induction hypothesis, M, k and M, k , so M, k . Also, by the

induction hypothesis, for such that j < k M, j . From the semantics of the modality , it then follows that M, i Since dnf ), we have consq ) (Lemma 4.2 (ii)). It then follows that M, Completeness Let . . . be a model such that M, . We have to show that is accepted by ( , G , G , . . ., G ). We begin with an auxiliary lemma. Lemma 4.4 Let be a state of such that for some M, i . Then there exists a state of such that: M, i +1 For all CL , if consq and δ / consq and M, i +1 , then consq Proof Let next consq δ / consq ) and M, i +1 . Note that next snext ) for, in general, if consq ) and

δ / consq ) then it must be the case that consq ). Let next snext next Since M, i , it must be the case that M, i +1 snext ). Hence M, i +1 next and M, i +1 next Let ∆ = next . From the definition of next M, i +1 for each ∆. For each ∆, since we know that dnf , there must be some dnf such that M, i +1 . Let Since M, i +1 must be consistent. Further, from the way dnf is defined on , it follows that dnf next ). Similarly, since M, i +1 next , there must be a set dnf next ) such that M, i +1 . We choose to be To show that , we note that dnf snext )) = dnf ((

next next )). We know that dnf next ) and dnf next ). Since M, i +1 and M, i +1 is consistent. Thus, dnf snext )). To check that Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 20
M Mukund: LTL and Buchi Automata 19 is a valid label, we just use the fact that M, i . So, if , then and if then p / Clearly, M, i +1 ). Further, for all ∆, consq ), since consq consq consq ). We use this lemma to produce an accepting run as follows. Firs t, note that in holds. Since M, , we have M, in , so in is non-empty—there must exist in such that M, From

the previous lemma, given M, , we can find such that and M, . Repeatedly applying the lemma, we extract a run . . . of Suppose that this run is not an accepting run. Then there is so me formula CL( and an index such that for all consq ) and δ / consq ). But consq +1 ), so M, k +1 by Lemma 4.2 (iv). So, there exists +1 such that M, j and for all +1 ` < j M, ` 6| . Since consq ) and δ / consq ) and M, j , by the preceding lemma we must have consq ) which is a contradiction. On-the-fly traversal We have shown that the automaton defined in terms of the functi on dnf

contains all possible models of the formula . This automaton can be constructed “on-the-fly”. We begin by constructing the states corresponding to dnf ). After that, whenever we need to find the successors of a node , we apply the function dnf to snext ). With some bookkeeping, we can avoid duplicating nodes. This is essentially what the algorithm in [GPVW95] computes, though they also combine some low-level optimiza tion with the basic algorithm A straightforward implementation of dnf yields an automaton which could potentially take time 2 for an input formula of length , even

though the total number of states is bounded by 2 . In contrast, the algorithm of [GPVW95] runs in 2 time [DSz96]. On the other hand, it is possible to build in optimizations wh en implementing dnf which could bring down the bound. The main point is that the dnf construction clearly brings out the formal basis for the on-the-fly construction, which i s somewhat obscured in the direct algorithmic reasoning of [GPVW95]. 5 Extensions The temporal logic we have considered ignores the labels on t he transitions of a program the model generated by a run is just the sequence of states it g oes

through. It is often useful to be able to talk about which transitions were used as well—for instance, in the set- ting of concurrent programs, the automaton is often specifie d as a synchronized product of sequential automata, where the synchronization mechanism is encoded via the actions per- formed. Normally, each sequential component comes equippe d with a local set of actions. If an action is common to more than one component, those compo nents must synchronize Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 21
M Mukund: LTL and Buchi

Automata 20 to perform the action. Actions which involve disjoint sets o f processes can be performed concurrently. It is not difficult to extend the syntax of LTL to include a modal ity which talks about actions—for each Σ, we introduce the modality . A model is no longer just a sequence of propositional valuations . . . , but instead a sequence of transitions of the form , where each is a subset of , as before, and each belongs to Σ. The semantics of the new modality is the obvious one. Let Then M, i i and M, i +1 α. Let us denote this extended version of LTL as

LTL(Σ). Both the global automata-theoretic construction of Sectio n 3 as well as the on-the-fly approach of [GPVW95] can be extended smoothly to LTL(Σ) [Mad 96]. Having extended LTL to talk about actions, the next challeng e is to exploit the con- currency present in the program specification to further red uce the complexity of model- checking. As we mentioned in the Introduction, here we have a ssumed that all program runs are represented as infinite sequences. However, when th e program involves concurrent actions, this approach generates many equivalent interlea

vings of the same stretch of con- current behaviour. It would be extremely useful if we can ide ntify just one representative sequence to be verified for each such class of interleavings. There is a considerable amount of work in progress on designi ng so-called “partial order methods” for verifying temporal properties of concur rent programs [GW94, Val90]. Another challenging task is to identify subclasses of formu las in LTL(Σ) which have the following property: if a formula is true in one representati ve interleaving of a concurrent run, then it is true in all interleavings.

Though some subset s of LTL(Σ) which have this property have been identified, the search for a full characte rization of this class is elusive [MT96]. Acknowledgments I thank Deepak D’Souza and P Madhusudan for shedding light on the subtleties of the on-the-fly method. In particular, the dnf based presentation of the [GPVW95] construction is due to Deepak. References [AHU74] A.V. Aho, J.E. Hopcroft and J.D. Ullman: The Design and Analysis of Algorithms , Addison-Wesley, Reading (1974). [Bu60] J.R. B uchi: On a decision method in restricted second order arithmetic, Z.

Math. Logik Grundlag. Math (1960) 66–92 [CVWY92] C. Courcoubetis, M. Vardi, P. Wolper and M. Yannakakis: Memory efficient algorithms for the verification of temporal logic pr operties, Formal Methods in System Design 1 (1992) 275–288. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997
Page 22
M Mukund: LTL and Buchi Automata 21 [DSz96] Deepak D’Souza: On-the-fly techniques for linear time temporal logic, Manuscript (1996). [GPVW95] R. Gerth, D. Peled, M. Vardi and P. Wolper: Simple on-the-fly au- tomatic verification of

linear temporal logic, Proc. IFIP/WG6.1 Symp. on Protocol Specification, Testing and Verification , Warsaw, Poland, June 1995. [GW94] P. Godefroid and P. Wolper: A partial approach to model checking, Inform. and Comput. 110 (1994) 305–326. [Mad96] P. Madhusudan: An on-the-fly algorithm for linear time temporal logic, M.Sc. Thesis , Anna University, Madras, India (1996). [MP91] Z. Manna and A. Pnueli The Temporal Logic of Reactive and Concurrent Systems (Specification) , Springer-Verlag, Berlin (1991). [MT96] M. Mukund and P.S. Thiagarajan : Linear time temporal logics

over Mazurkiewicz traces, Proc MFCS ’96 LNCS 1113 (1996) 62–92. [Pnu77] A. Pnueli: The temporal logic of programs, Proc. 18th IEEE FOCS (1977) 46–57. [SVW87] A.P. Sistla, M. Vardi and P. Wolper: Reasoning about infinite compu- tation paths, Proc. 24th IEEE FOCS (1983) 185–194. [Th90] W. Thomas: Automata on infinite objects, in J. van Leeuwen (ed.), Hand- book of Theoretical Computer Science, Volume B , North-Holland, Amsterdam (1990) 133–191. [Th96] W. Thomas: Languages, automata and logic, Report 9607, Institut fur I nfor- matik und Praktische Mathematik,

Christian-Albrechts-Un iversitat, Kiel, Ger- many, May 1996. (Preliminary version of a chapter to appear i n G. Rozenberg, A. Salomaa (eds.), Handbook of Formal Language Theory , Springer-Verlag.) [Val90] A. Valmari : Stubborn sets for reduced state space generation, LNCS 483 (1990) 491–515. [VW86] M. Vardi and P. Wolper: An automata theoretic approach to automatic program verification, Proc. 1st IEEE LICS , (1986) 332–345. [VW94] M. Vardi and P. Wolper: Reasoning about infinite computations, Inform. Comput. 115 (1) (1994) 1–37. Winter School on Logic & Computer Science ISI

Calcutta, Dec 1996–Jan 1997