ernetin Abstract Over the past two decades temporal logic has become a very ba sic tool for spec ifying properties of reactive systems For 64257nitestate sys tems it is possible to use techniques based on B57512uchi automata to verify if a system mee ID: 22330 Download Pdf

144K - views

Published bypasty-toler

ernetin Abstract Over the past two decades temporal logic has become a very ba sic tool for spec ifying properties of reactive systems For 64257nitestate sys tems it is possible to use techniques based on B57512uchi automata to verify if a system mee

Download Pdf

Download Pdf - The PPT/PDF document "LinearTime Temporal Logic and Buchi Auto..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Page 1

Linear-Time Temporal Logic and Buchi Automata Madhavan Mukund SPIC Mathematical Institute 92 G N Chetty Road Madras 600 017, India E-mail: madhavan@ssf.ernet.in Abstract Over the past two decades, temporal logic has become a very ba sic tool for spec- ifying properties of reactive systems. For ﬁnite-state sys tems, it is possible to use techniques based on Buchi automata to verify if a system mee ts its speciﬁcations. This is done by synthesizing an automaton which generates al l possible models of the given speciﬁcation and then verifying

if the given syste m reﬁnes this most gen- eral automaton. In these notes, we present a self-contained introduction to the basic techniques used for this automated veriﬁcation. We also des cribe some recent space- eﬃcient techniques which work on-the-ﬂy.

Page 2

M Mukund: LTL and Buchi Automata Introduction Program veriﬁcation is a fundamental area of study in comput er science. The broad goal is to verify whether a program is “correct”—i.e., whether th e implementation of a program meets its speciﬁcation. This is, in general, too

ambitious a goal and several assumptions have to be made in order to render the problem tractable. In th ese lectures, we will focus on the veriﬁcation of ﬁnite-state reactive programs . For specifying properties of programs, we use linear time temporal logic. What is a reactive program? The general pattern along which a conventional program executes is the following: it accepts an input, performs som e computation, and yields an output. Thus, such a program can be viewed as an abstract func tion from an input domain to an output domain whose behaviour consists of a transforma

tion from initial states to ﬁnal states. In contrast, a reactive program is not expected to terminate . As the name suggests, such systems “react” to their environment on a continuous basis, responding appropriately to each input. Examples of such systems include operating syst ems, schedulers, discrete-event controllers etc. (Often, reactive systems are complex dist ributed programs, so concurrency also has to be taken into account. We will not stress on this as pect in these lectures—we take the view that a run of a distributed system can be represe nted as a sequence, by arbitrarily

interleaving concurrent actions.) To specify the behaviour of a reactive system, we need a mecha nism for talking about the way the system evolves along potentially inﬁnite comput ations. Temporal logic [Pnu77] has become a well-established formalism for this purpose. M any varieties of temporal logic have been deﬁned in the past twenty years—we focus on proposi tional linear time temporal logic (LTL). There is an intimate connection between models of LTL formul as and languages of inﬁnite words—the models of an LTL formula constitute an -regular language over an

appropriate alphabet. As a result, the satisﬁability probl em for LTL reduces to checking for emptiness of -regular languages. This connection was ﬁrst explicitly po inted out in [SVW87]. Later, in [VW86], the connection between LTL and -regular languages has been ex- tended to model checking . Unlike the satisﬁability problem, which asks if a given for mula has a model, the model-checking problem is one of veriﬁcatio n: the task is to verify whether a given ﬁnite-state program satisﬁes a speciﬁcation . This consists of checking that all runs of

constitute models for . Since ﬁnite-state reactive programs can be represented quite naturally as Buchi automata, model-che cking also reduces to a problem in automata theory. It suﬃces to show that no run of is a model for , which is the same as checking that the intersection of the language accep ted by and the language deﬁned by is empty. In recent years, the techniques proposed in [VW86] have move d from the realm of theory to practice. In this context, there has been renewed e mphasis on reducing the complexity of the automata-theoretic method. One fruitful

approach is to build up the automaton associated with a formula “on-the-ﬂy” so that onl y as much of the automaton Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 3

M Mukund: LTL and Buchi Automata is constructed as is needed to settle the model-checking pro blem. A ﬁrst step in this regard is the algorithm proposed in [GPVW95]. This write-up is organized as follows. We begin with a descri ption of the logical language LTL. We then provide a quick introduction to Buchi automata in Section 2. In Section 3 we describe the

basic automata-theoretic approach of [VW86]. Next, in Section 4, we present a formal basis for the on-the-ﬂy method of [GPVW95]. We concl ude with some pointers to ways in which these approaches can be extended in more gene ral settings. 1 Linear-time temporal logic Linear time temporal logic is a logic for talking about inﬁni te sequences, where each element in the sequence corresponds to a propositional world. Syntax We ﬁx a countable set of atomic propositions , p , . . . . Then Φ, the set of formulas of LTL, is deﬁned inductively as follows: Every member of

belongs to Φ. If and are formulas in Φ, then so are O and The connectives and correspond to the usual Boolean connectives “not” and “or respectively. The modality to be read as “next” while the binary modality is to be read as “until”. Thus O is “next ” while is until ”. Semantics model is a function . In other words, a model is an inﬁnite sequence . . . of subsets of . The function describes how the truth of atomic propositions changes as time progresses. We write M, i to denote that is true at time instant in the model ”. This notion is deﬁned inductively, according

to the structure of M, i , where ∈ P , i ). M, i i M, i 6| M, i i M, i or M, i M, i O i M, i +1 M, i iﬀ there exists such that M, k and for all such that j < k M, j Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 4

M Mukund: LTL and Buchi Automata A formula is said to be satisﬁable if there exists a model and an instant such that M, i . Since the modalities we have deﬁned only talk about future t ime-points within a model, it is not diﬃcult to argue that a formula is satisﬁable iﬀ in some model it

is satisﬁed at the initial point. Proposition 1.1 Let be a formula in . Then is satisﬁable iﬀ there exists a model such that M, Another simple observation is that in order to satisfy a form ula , a model needs to assign truth values only to those propositions which occur in . Let Voc( ), the “vocabulary of , denote the subset of which is mentioned in . Voc( ) can be deﬁned inductively quite easily: Voc( ) = Voc( ) = Voc( Voc( ) = Voc( Voc( Voc( O ) = Voc( Voc( ) = Voc( Voc( If is a model and is a formula, let Voc( be a new model where for all Voc( ) = Voc( ). We

then have the following simple fact. Proposition 1.2 Let be a model and be a formula. Then, for all M, i i Voc( , i Derived connectives As usual, we introduce constants and representing “true” and “false”. We can write as, for instance, (recall that , p , . . . ) and as > We can also generate normal Boolean connectives like (“and”), (“implies”) and (“iﬀ”) from the connectives and in the usual way—for instance, We also introduce two derived modalities based on . We write for >U and for . The modality is read as “eventually” while the modality is read as “henceforth”. Let be a

model. It is not diﬃcult to verify the following facts: M, i iﬀ there exists such that M, k M, i iﬀ for all M, k Examples Here are some examples of the kinds of assertions we can make i n temporal logic. The formula 32 says that is eventually a “stable property” of the system M, i 32 iﬀ for some , for all M, k Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 5

M Mukund: LTL and Buchi Automata On the other hand, 23 asserts that holds inﬁnitely often. If we use the full power of , we can make some fairly complex

statements about a program’s behaviour. For instance, consider a system whic h schedules access to a shared resource among competing processes which are named, for convenience, , . . ., k . For each process , we could have two atomic propositions and to denote the state of vis-a-vis the shared resource—proposition is true if process has requested the resource but has not yet got access to it, while is true when is granted access to the resource. The formula asserts that process continues to be in a requesting state until access to the resource is granted. A desirable property that the system

should satisfy is that for all , the formula )) is true at the initial state—i.e., the scheduler eventually grants every request. For a detailed exposition of how to specify properties of rea ctive systems in temporal logic, the reader is referred to the book [MP91]. 2 Buchi automata Automata on inﬁnite inputs were introduced by Buchi in [Bu 60]. A Buchi automaton is a non-deterministic ﬁnite-state automaton which takes in nite words as input. A word is accepted if the automaton goes through some designated “g ood” states inﬁnitely often

while reading it. We begin with some notation for inﬁnite words. Let Σ be a ﬁnite alphabet. An inﬁnite word is an inﬁnite sequence of symbols from Σ. We shall represent as a function Σ, where is the set , . . . of natural numbers. Thus, ) denotes the letter occurring at the th position. In general, if is a set and an inﬁnite sequence of symbols over —in other words, —then inf ) denotes the set of symbols from which occur inﬁnitely often in . Formally, inf ) = | ) = , where denotes the quantiﬁer “there exist inﬁnitely many”.

Automata An automaton is a triple = ( S, , S in ) where is a set of states in is a set of initial states and is a transition relation . Normally, we write to denote that ( s, a, s The automaton is said to be deterministic if in is a singleton and is a function from Σ to . The automata we encounter in this paper will, in general, be non-deterministic. Runs Let = ( S, , S in ) be an automaton and Σ an input word. A run of on is a inﬁnite sequence such that (0) in and for all +1). Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 6

M Mukund:

LTL and Buchi Automata Figure 1: A typical accepting run of a Buchi automaton, with in and So, a run is just a “legal” sequence of states that an automato n can pass through while reading the input. In general, an input may admit many r uns because of non- determinism. Since a non-deterministic automaton may have states where there are no outgoing transitions corresponding to certain input lette rs, it is also possible that an input admits no runs—in this case, every potential run leads to a state from w here there is no outgoing transition enabled for the next input letter. If

th e automaton is deterministic, each input admits precisely one run. Buchi automata Buchi automaton is a pair ( , G ) where = ( S, , S in ) and denotes a set of good states . The automaton ( , G accepts an input Σ if there is a run of on such that inf . The language recognized by , G ), , G ), is the set of all inﬁnite words accepted by ( , G ). A set is said to be Buchi-recognizable if there is a Buchi automaton ( , G ) such that , G ). According to the deﬁnition, a Buchi automaton accepts an in put if there is a run along which some

subset of occurs inﬁnitely often. Since is a ﬁnite set, it is easy to see that there must actually be a state which occurs inﬁnitely often along . In other words, if we regard the state space of a Buchi automaton as a g raph, an accepting run traces an inﬁnite path which starts at some state in in , reaches a good state and, thereafter, keeps looping back to inﬁnitely often (see Figure 1). Example 2.1 Consider the alphabet Σ = a, b . Let consist of all inﬁnite words such that there are inﬁnitely many occurrences of in . Figure 2

shows a Buchi automaton recognizing . The initial state is marked by an unlabelled incoming arrow There is only one good state, which is indicated with a double circle. In this automaton, all transitions labelled lead into the good state and, conversely, all transitions co ming into the good state are labelled . From this, it follows that the automaton accepts an inﬁnite word iﬀ it has inﬁnitely many occurrences of The complement of , which we denote , is the set of all inﬁnite words such that has only ﬁnitely many occurrences of . An automaton

recognizing is shown in Figure 3. The automaton guesses a point in the input beyond which it wil l see no more ’s—such a point must exist in any input with only a ﬁnite number of ’s. Once it has made this guess, it can process only ’s—there is no transition labelled from the second state—so if it reads any more ’s it gets stuck. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 7

M Mukund: LTL and Buchi Automata Figure 2: A Buchi automaton for (Example 2.1) a, b Figure 3: A Buchi automaton for (Example 2.1) In the example,

notice that the automaton recognizing is deterministic while the au- tomaton for is non-deterministic. It can be shown that the non-determin ism in the second case is unavoidable—that is, there is no deterministic automaton recognizing This means that Buchi automata are fundamentally diﬀerent from their counterparts on ﬁnite inputs: we know that over ﬁnite words, deterministic a utomata are as powerful as non-deterministic automata. 2.1 Constructions on Buchi automata It turns out that the class of Buchi-recognizable language s is closed under

boolean opera- tions. Union To show closure under ﬁnite union, let ( , G ) and ( , G ) be two Buchi au- tomata. To construct an automaton ( , G ) such that , G ) = , G , G ), we take to be the disjoint union of and . Since we are permitted to have a set of initial states in , we retain the initial states from both copies. If a run of starts in an initial state contributed by , it will never cross over into the state space contributed by and vice versa. Thus, we can set the good states of to be the union of the good states contributed by both components. Complementation Showing

that Buchi-recognizable languages are closed und er com- plementation is highly non-trivial. One problem is that we c annot determinize Buchi automata. Even if we could work with deterministic automata , the formulation of Buchi Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 8

M Mukund: LTL and Buchi Automata acceptance is not symmetric with respect to complementatio n in the following sense. Sup- pose ( , G ) is a deterministic Buchi automaton and is an inﬁnite word which does not belong to , G ). Then,

the (unique) run of on is such that inf( . Let denote the complement of . It follows that inf( , since some state must occur inﬁnitely often in . It would be tempting to believe that the automaton ( recognizes , G ). However, there may be words which admit runs which visit bo th and inﬁnitely often. These words will be including both in ) as well as in , G ). So, there is no convenient way to express the complement of a Buchi condition again as a Buchi condition. Fortunately, we shall not need t o complement Buchi automata for any of the constructions

which we describe here. Intersection Turning to intersection, the natural way to intersect autom ata and is to construct an automaton whose state space is the cross pr oduct of the state spaces of and and let both copies process the input simultaneously. For ﬁn ite words, the input is accepted if each copy can generate a run which reache s a ﬁnal state at the end of the word. For inﬁnite inputs, we have to do a more sophisticated produc t construction. An inﬁnite input should be accepted by the product system provided both copie s generate runs which visit good

states inﬁnitely often. Unfortunatel y, there is no guarantee that these runs will ever visit good states simultaneously—for i nstance, it could be that the ﬁrst run goes through a good state after (0), (2), ...while the second run enters good states after (1), (3), ... So, the main question is one of identifying the good s tates of the product system. The key observation is that to detect that both components of the product visit good states inﬁnitely often, one need not record every point where the copies visit good states; in each copy, it suﬃces to observe an

inﬁnite subsequence of t he overall sequence of good states. So, we begin by focusing on the ﬁrst copy and waiting f or its run to enter a good state. When this happens, we switch attention to the other co py and wait for a good state there. Once the second copy reaches a good state, we switch ba ck to the ﬁrst copy and so on. Clearly, we will switch back and forth inﬁnitely often iﬀ both copies visit their respective good states inﬁnitely often. Thus, we can charac terize the good states of the product in terms of the states where one switches back

and for th. Formally, the construction is as follows. Let ( , G ) and ( , G ) be two Buchi au- tomata such that = ( , S in ) for = 1 2. Deﬁne ( , G ), where = ( S, , S in ), as follows: { The transition relation is deﬁned as follows: , s 1) , s 1) if and , s 1) , s 2) if and , s 2) , s 2) if and Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 9

M Mukund: LTL and Buchi Automata , s 2) , s 1) if and in , s 1) in and in { In the automaton , each product state carries an extra tag indicating whether the au-

tomaton is checking for a good state on the ﬁrst or the second c omponent. The automaton accepts if it switches focus from the second component to the ﬁrst inﬁnitely often. (Notice that we could equivalently have deﬁned to be the set { .) It is not diﬃcult to verify that , G ) = , G , G ). Emptiness In applications, we will need to be able to check whether the l anguage ac- cepted by a Buchi automaton is empty. To do this, we recall ou r observation that any accepting run of a Buchi automaton must begin in an initial s tate, reach a

ﬁnal state and then cycle back to inﬁnitely often. If we ignore the labels on the transitions, we can regard the s tate space of a Buchi automaton ( , G ) as a directed graph = ( , E ) where and ( s, s i for some Σ, . Recall that a set of vertices in a directed graph is a strongly connected component iﬀ for every pair of vertices v, v , there is a path from to Clearly, , G ) is non-empty iﬀ there is a strongly connected component in such that contains a vertex from and is reachable from one of the initial states. We thus have the following theorem.

Theorem 2.2 The emptiness problem for Buchi automata is decidable. Notice that it is suﬃcient to analyze maximal strongly connected components in in order to check that , G . Computing the maximal strongly connected components of a directed graph can be done in time linear in the size of the graph [AHU74], where the size of a graph = ( V, E ) is, as usual, given by . Checking reachability can also be done in linear time. So, if has states, checking that , G can be done in time ). 2.2 Generalized Buchi automata When expressing the connection between temporal logic and B

uchi automata, it is often convenient to work with a slightly more elaborate acceptanc e condition. A generalized Buchi automaton is a structure ( , G , G , . . ., G ), where = ( S, , S in ) and for all ∈ { , . . ., k An input is accepted by the automaton ( , G , G , . . ., G ) if there is a run of on such that inf for all ∈ { , . . ., k . As usual, , G , G , . . ., G denotes the language of all inﬁnite words accepted by the aut omaton ( , G , G , . . ., G ). The following observation is immediate. Winter School on Logic & Computer Science ISI Calcutta, Dec

1996–Jan 1997

Page 10

M Mukund: LTL and Buchi Automata Proposition 2.3 Let , G , G , . . ., G be a generalized Buchi automaton. Then , G , G , . . ., G ) = ∈{ ,...,k , G In other words, every language which is recognized by a gener alized Buchi automaton is also Buchi recognizable. It is not diﬃcult to argue that che cking whether the language accepted by a generalized Buchi automaton is empty is no har der, in terms of computational complexity, than the corresponding check for a normal Buch i automaton. Further reading The

languages recognized by Buchi automata correspond to -regular languges. These languages have a syntactic characterization in terms of reg ular languages of ﬁnite strings. They can also be characterized logically using the monadic s econd order theory of one successor (S1S). For a more detailed introduction to the the ory of automata on inﬁnite words, the reader is encouraged to consult the excellent sur veys by Thomas [Th90, Th96]. 3 Automata-theoretic methods As we saw in the last section, a model for an LTL formula is a function We also saw that to check whether is

satisﬁable, it suﬃces to look at models deﬁned over Voc( ). In other words, we can restrict our attention to models of t he form . . . where each is a subset of Voc( ). Since Voc( ) is ﬁnite, we can treat each model as an inﬁnite word over the ﬁnite alphabet 2 Voc( The result we shall establish is that the set of all inﬁnite wo rds over 2 Voc( which are models for —i.e., the set Mod( ) = . . . M, actually constitutes a Buchi recognizable language. We sh all also demonstrate how to explicit construct a generalized Buchi automaton

( , G , G , . . ., G ) over the alphabet Voc( such that , G , G , . . ., G ) = Mod( ). 3.1 Satisﬁability We begin by deﬁning the (Fischer-Ladner) closure of a formul a. Closure Let be an LTL formula. Then CL ) is the smallest set of formulas such that: CL ). If CL ), then CL ). Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 11

M Mukund: LTL and Buchi Automata 10 If CL ), then β, CL ). If O CL ), then CL ). If CL ), then β, γ, O CL ). Finally, CL( ) = CL ∪ { CL , where we identify with Notice that CL( ) is

always ﬁnite, even though the clause for throws in a larger formula into the set. In fact, if contains symbols, then CL( is ). The automaton that we associate with a formula will have as its states subsets of CL( ) which are both propositionally and temporally “consisten t”. These subsets are called atoms. Atoms Let be a formula. Then CL( ) is an atom if: CL( ), i β / CL( ), i or CL( ), i or β, O Let AT be the set of all atoms of Constructing a Buchi automaton for We ﬁrst construct an automaton = ( S, , S in ) over the alphabet 2 Voc( , where: AT Let A, B

∈ AT and Voc( ). Then iﬀ the following hold. Voc( ). For all O CL( ), O i in ∈ AT | Let , , . . ., be the set of until formulas which appear in CL( ). We add a generalized Buchi acceptance condition ( , G , . . ., G ) where for each ∈ AT | or We then have the following theorem. Theorem 3.1 Let be an inﬁnite word over Voc( . Then , G , G , . . ., G i M, Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 12

M Mukund: LTL and Buchi Automata 11 Proof ) Let . . . be an inﬁnite word over Voc( ) which is

accepted by , G , G , . . ., G ). Let . . . be an accepting run of on . For all CL( and for all , we show that M, i i The proof is by induction on the structure of ∈ P Then M, i i i Then M, i i M, i 6| iﬀ (by the induction hypothesis) γ / i (by the deﬁnition of an atom). Then M, i iﬀ ( M, i or M, i ) iﬀ—by the induction hypothesis—( or ) iﬀ—by the deﬁnition of an atom O Then M, i i M, i +1 iﬀ (by the induction hypothesis) +1 iﬀ (by the deﬁnition of +1 O Suppose that M, i . We must show that . By the semantics of the

modality , there exists such that M, k and for all j < k M, j . We show that by a second induction on Base case: = 0) Then and M, i . By the main induction hypothesis, , whence, from the deﬁnition of atoms, Induction step: ` > 0) By the semantics of the modality M, i and M, i +1 . Then, by the secondary induction hypothesis, +1 . From the deﬁnition of +1 , we then have (recall that if CL( ) then CL( ) as well). By the main induction hypothesis, we also have . Combining these facts, from the deﬁnition of an atom, Conversely, suppose . We must show that M, i . Recall that we

have indexed the until formulas in CL( ) by 1 , . . ., k . Let be the index of Since . . . is an accepting run of ( , G , G , . . ., G ), there must exist a such that . Choose the least such . Once again, we do a second induction on to show that M, i Base case: = 0) If , then . Since , the only way for to be in is for to also belong to . Then, by the main induction hypothesis, M, i , whereby M, i as well. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 13

M Mukund: LTL and Buchi Automata 12 Induction step: ` > 0) Since δ / . From the

deﬁnition of atoms, both and ) must be in . Since +1 , it must be the case that and +1 . By the secondary induction hypothesis, M, i +1 while by the main induction hypothesis M, i . From the semantics of the modality , it then follows that M, i as well. ) Suppose that . . . such that M, . We have to show that , G , G , . . ., G ). In other words, we have to exhibit an accepting run of the au toma- ton on For , deﬁne to be the set CL( M, i . It is easy to verify that each is an atom. We can also verify that each adjacent pair of atoms and +1 satisfy the conditions speciﬁed

for the existence of an arrow +1 . Finally, since M, we have , so is an initial state in . From all this, it follows that . . . is a run of the automaton on To check that it is an accepting run, we have to verify that eac h good set is met inﬁnitely often. Suppose this is not the case—i.e., for some and some index for all . In other words, for all , the th until formula in CL( ), , belongs to and . Since CL( M, k , it follows that M, k . But, since for all , it follows that M, j for all which contradicts the fact that M, k It follows from the preceding theorem that is satisﬁable

iﬀ the language recognized by , G , G , . . ., G ) is non-empty. Let the length of be . Since the size of CL( ) is linear in , it follows that the number of states in is bounded by 2 . Since checking for non-emptiness can be done in time (2 = 2 , the satisiﬁability problem for a formula of length is solvable in time 2 3.2 Model checking Let us model ﬁnite-state reactive programs as (generalized ) Buchi automata—a program is a structure = (( S, , S in , G , G , . . ., G ). The acceptance condition may trivial—i.e., we could have = 1 and We use atomic propositions to

characterize properties sati siﬁed by the states of the program. In other words, a program comes with a function → P which describes the properties of each state. Each run of generates a model in the obvious way. Let . . . be a run of —in other words, in and for all +1 . This induces a model → P given by ) = )) for all The model-checking problem is the following: given a progra and a valuation together with a speciﬁcation , does every run of satisfy ? In other words, we want to check that the set Mod( ) = is a run of is a subset of Mod( ), the set of models of . This

is equivalent to saying that Mod( ) does not contain any model of Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 14

M Mukund: LTL and Buchi Automata 13 To check this, we ﬁrst construct an automaton ( , G , G , . . ., G ) from ( P, V ) over the alphabet 2 Voc( as follows. Let = (( S, , S in , G , G , . . ., G ). Then , S in ), where s, Q, s | a. s and Voc( in in The following is then obvious: Theorem 3.2 Let P, V be a program and be a formula. Then all models generated by satisfy i ) = Recall that intersecting two Buchi automata

is just a simpl e extension of the product construction. From this it follows that the complexity of se ttling the model checking problem is ), where is the the number of states in and is the length of 4 On-the-ﬂy methods The construction described in the previous section require s us to construct the entire automaton in order to solve the model-checking problem. In particular , the emptiness check at the end of the procedure assumes that the entire auto maton is available in memory in order to search for an accepting run. A simple way to get around this memory requirement is to explo

re the state space in an incremental fashion. For instance, in [CVWY92], a dept h-ﬁrst-search (DFS) based strategy is used to detect cycles and hence check for emptine ss, rather than looking for strongly connected components directly in the full automat on graph. Such a strategy can be implemented along with an “on-the-ﬂy construction of the automaton—when constructing the product of the program aut omaton and the formula automaton, we generate the states of the product incrementa lly, as and when they are explored by the DFS-based cycle-detection strategy. In the process, if we

ﬁnd an accepting cycle, we can abort the search without generating the entire state space. Of course, in the worst case (which occurs when the program does meet the speciﬁcation given the formula!), we end up having to explore the entire state space. To generate the product state space on the ﬂy, we have to ﬁrst h ave a method for constructing both the program automaton and formula automa ton on-the-ﬂy, individually. In many applications, the program to be veriﬁed is a concurre nt system speciﬁed in terms of its components. In order to apply the

technique disc ussed in the previous section, we have to generate the global state space of the concurrent p rogram. The obvious on-the- ﬂy approach is to generate these global states as and when the need arises. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 15

M Mukund: LTL and Buchi Automata 14 More tricky is to ﬁnd an on-the-ﬂy approach for generating th e formula automaton. A procedure for achieving this is described in [GPVW95]. How ever, the construction presented in [GPVW95] is fairly opaque thanks to the fact tha t

it blurs the distinction between the basic strategy used for on-the-ﬂy generation an d some speciﬁc optimizations which improve the overall performance. Here, we present the basis a technically cleaner version of t he [GPVW95] algorithm (which is admittedly less eﬃcient overall). However, by sep arately applying optimizations to our construction, we can improve the complexity bounds. T he construction described here is from [DSz96]. Now and next-state requirements Though LTL formulas are intepreted on inﬁnite runs, the deﬁn ition of the satisfaction relation

for LTL gives rise to what may be called a “two-state ” semantics. Every LTL formula can be thought of as specifying two sets of requirements: one set to be satisﬁed “now” and the rest to be satisﬁed in the “next state”. For inst ance, the formula says that either is true now, or is true now and is true in the next state. By repeatedly breaking down a formula, we can put it in a sort o f disjunctive normal form, which speciﬁes all possible ways of making the formula true. For instance, the formula ) breaks down into two sets of requirements, p, q, O and p, r . If either of

these sets is true, the original formula is true. Notice th at each of these sets internally breaks up into current requirements (e.g., p, q in the ﬁrst set) and next-state requirements ) in the ﬁrst set). We would like to formalize this notion: a formula will genera te an automaton whose states are sets like the ones above. Each set represents one w ay of making some requirement true. A state is a valid next state for a state if it is one of the ways of satisfying the next-state formulas in Positive formulas We modify the syntax of LTL so that all negations appear only a t the

level of atomic propositions. Formally, we begin with a set of atomic propos itions , together with pre- deﬁned constants and . Let denote the set { ∈ P} . Then , the set of LTL formulas in positive form , is deﬁned inductively as follows: • > and belong to Every member of and belongs to If and are formulas in , then so are O and The semantics is , O and is as before. The formula is an abbreviation for U ). It is easy to check that Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 16

M Mukund: LTL and Buchi Automata 15 M, i

iﬀ either for all M, k or there is a such that M, j and for all M, ` Notice that any LTL formula can be converted into a positive f ormula by pushing all negations inwards to the level of atomic propositions. The r esulting formula may be longer, but is still linear in the size of the original formula. Hence forth, we assume that all formulas we encounter are from For a set of formulas , let next ) = O O and snext ) = O In other words, snext ) consists of all -formulas in stripped of the modality. We use to denote the conjunction of formulas in and to denote the disjunction of formulas

in . We adopt the convention that and Disjunctive normal form To formalize the notion of breaking down a formula into all possible ways of satisfying it, we introduce a version of dis junctive normal form. Let dnf : Sets of subsets of P P next ( be given by: dnf ) = {∅} dnf ) = dnf ) = {{ }} for p, p, O dnf ) = dnf dnf dnf ) = dnf , D dnf , C is propositionally consistent dnf ) = dnf )) dnf dnf ) = dnf dnf )) Thus the function dnf breaks up a formula into a set of sets of formulas. Each lower level set represents a clause in an extended version of disju nctive normal form, where

propositions, their negations and next formulas are treate d as literals. The modalities and are interpreted as disjunctions over their “two-state sema ntics”. We can prove the following by induction on the structure of fo rmulas. Lemma 4.1 For all formulas dnf Let us ﬁx a formula . We extend the notion of CL( ) to cover the new modality in the obvious way: if CL( ), then β, CL( ). In our on-the-ﬂy construction, we will not work with fully sp eciﬁed atoms. Instead, we normally work with “unsaturated” subsets CL( ). For such a subset , we deﬁne consq ), the

logical consequences of as follows. Let CL( ). Then consq ) is the smallest subset of CL( ) such that: Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 17

M Mukund: LTL and Buchi Automata 16 consq If > CL( ) then > consq ). For all CL( ), if consq ) or consq ) then consq ). For all CL( ), if β, consq ) then consq ). For all CL( ), if β, O consq ) or consq ) then consq ). For all CL( ), if β, consq ) or β, O consq ) then consq ). The following properties of consq are not diﬃcult to prove. Lemma 4.2 Let CL and X, Y CL .

Then (i) If then consq consq (ii) If dnf then consq (iii) If and dnf , then consq (iv) Let . . . be a model. If M, then M, consq We can now deﬁne a generalized Buchi automaton correspondi ng to a formula . The automaton = ( S, , S in ) over 2 Voc( is given by: = Subsets of P P next (CL( )). in dnf ). iﬀ the following are true: ∩ P | } dnf snext )). Notice that we could now have many diﬀerent arrows between a pair of states and , since and are no longer atoms. In general, a labelled-arrow exists provided does not contradict the propositional assertions in As

before let , , . . ., be the set of until formulas which appear in CL( ). We add a generalized Buchi acceptance condition ( , G , . . ., G ) where for each consq ) or consq We want to show that . . . is accepted by ( , G , G , . . ., G ) i M, We break the proof up into two parts. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 18

M Mukund: LTL and Buchi Automata 17 Soundness Let . . . be accepted by ( , G , G , . . ., G ). We need to show that M, Let . . . be an accepting run for . We show the following: Lemma 4.3 CL , if consq then M, i

Proof By induction on the structure of ∈ P If consq ) then which implies that which implies that M, i p, p ∈ P If consq ) then which implies that p / which implies that M, i Since consists of formulas from P P next ( ), it cannot be the case that . Thus, we must have derived the fact that consq ) using our inductive deﬁnition of consq ). From this, it follows that either consq or consq ). By the induction hypothesis, either M, i or M, i , so M, i Once again, it cannot be the case that . From the fact that consq ), it follows that consq ) and consq ). By the induction

hypothesis, M, i and M, i , so M, i O If O consq ) then O . So snext ). Since +1 dnf snext )), it follows from Lemma 4.2 (ii) that consq +1 ). By the induction hypothesis, M, i +1 , so M, i O In general if and consq ), then either consq ) or consq ) and consq ). So, if consq ), it follows either that for all consq ) and δ / consq ) or that there exists such that consq ) and for all such that j < k consq ). The ﬁrst case is ruled out by the fact that . . . is an accepting run. By the induction hypothesis, the second case yields M, k and M, j whereby M, i In general if and consq ),

then either consq ) or consq ) and consq ). It follows that either for all consq Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 19

M Mukund: LTL and Buchi Automata 18 and consq ) or there exists such that consq ) and for all such that j < k consq ). If the ﬁrst case holds, by the induction hypothesis, we have M, k for all so M, i by the semantics of the modality . If the second case holds, from the deﬁnition of consq , it follows that γ, consq ). Hence, by the induction hypothesis, M, k and M, k , so M, k . Also, by the

induction hypothesis, for such that j < k M, j . From the semantics of the modality , it then follows that M, i Since dnf ), we have consq ) (Lemma 4.2 (ii)). It then follows that M, Completeness Let . . . be a model such that M, . We have to show that is accepted by ( , G , G , . . ., G ). We begin with an auxiliary lemma. Lemma 4.4 Let be a state of such that for some M, i . Then there exists a state of such that: M, i +1 For all CL , if consq and δ / consq and M, i +1 , then consq Proof Let next consq δ / consq ) and M, i +1 . Note that next snext ) for, in general, if consq ) and

δ / consq ) then it must be the case that consq ). Let next snext next Since M, i , it must be the case that M, i +1 snext ). Hence M, i +1 next and M, i +1 next Let ∆ = next . From the deﬁnition of next M, i +1 for each ∆. For each ∆, since we know that dnf , there must be some dnf such that M, i +1 . Let Since M, i +1 must be consistent. Further, from the way dnf is deﬁned on , it follows that dnf next ). Similarly, since M, i +1 next , there must be a set dnf next ) such that M, i +1 . We choose to be To show that , we note that dnf snext )) = dnf ((

next next )). We know that dnf next ) and dnf next ). Since M, i +1 and M, i +1 is consistent. Thus, dnf snext )). To check that Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 20

M Mukund: LTL and Buchi Automata 19 is a valid label, we just use the fact that M, i . So, if , then and if then p / Clearly, M, i +1 ). Further, for all ∆, consq ), since consq consq consq ). We use this lemma to produce an accepting run as follows. Firs t, note that in holds. Since M, , we have M, in , so in is non-empty—there must exist in such that M, From

the previous lemma, given M, , we can ﬁnd such that and M, . Repeatedly applying the lemma, we extract a run . . . of Suppose that this run is not an accepting run. Then there is so me formula CL( and an index such that for all consq ) and δ / consq ). But consq +1 ), so M, k +1 by Lemma 4.2 (iv). So, there exists +1 such that M, j and for all +1 ` < j M, ` 6| . Since consq ) and δ / consq ) and M, j , by the preceding lemma we must have consq ) which is a contradiction. On-the-ﬂy traversal We have shown that the automaton deﬁned in terms of the functi on dnf

contains all possible models of the formula . This automaton can be constructed “on-the-ﬂy”. We begin by constructing the states corresponding to dnf ). After that, whenever we need to ﬁnd the successors of a node , we apply the function dnf to snext ). With some bookkeeping, we can avoid duplicating nodes. This is essentially what the algorithm in [GPVW95] computes, though they also combine some low-level optimiza tion with the basic algorithm A straightforward implementation of dnf yields an automaton which could potentially take time 2 for an input formula of length , even

though the total number of states is bounded by 2 . In contrast, the algorithm of [GPVW95] runs in 2 time [DSz96]. On the other hand, it is possible to build in optimizations wh en implementing dnf which could bring down the bound. The main point is that the dnf construction clearly brings out the formal basis for the on-the-ﬂy construction, which i s somewhat obscured in the direct algorithmic reasoning of [GPVW95]. 5 Extensions The temporal logic we have considered ignores the labels on t he transitions of a program the model generated by a run is just the sequence of states it g oes

through. It is often useful to be able to talk about which transitions were used as well—for instance, in the set- ting of concurrent programs, the automaton is often speciﬁe d as a synchronized product of sequential automata, where the synchronization mechanism is encoded via the actions per- formed. Normally, each sequential component comes equippe d with a local set of actions. If an action is common to more than one component, those compo nents must synchronize Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 21

M Mukund: LTL and Buchi

Automata 20 to perform the action. Actions which involve disjoint sets o f processes can be performed concurrently. It is not diﬃcult to extend the syntax of LTL to include a modal ity which talks about actions—for each Σ, we introduce the modality . A model is no longer just a sequence of propositional valuations . . . , but instead a sequence of transitions of the form , where each is a subset of , as before, and each belongs to Σ. The semantics of the new modality is the obvious one. Let Then M, i i and M, i +1 α. Let us denote this extended version of LTL as

LTL(Σ). Both the global automata-theoretic construction of Sectio n 3 as well as the on-the-ﬂy approach of [GPVW95] can be extended smoothly to LTL(Σ) [Mad 96]. Having extended LTL to talk about actions, the next challeng e is to exploit the con- currency present in the program speciﬁcation to further red uce the complexity of model- checking. As we mentioned in the Introduction, here we have a ssumed that all program runs are represented as inﬁnite sequences. However, when th e program involves concurrent actions, this approach generates many equivalent interlea

vings of the same stretch of con- current behaviour. It would be extremely useful if we can ide ntify just one representative sequence to be veriﬁed for each such class of interleavings. There is a considerable amount of work in progress on designi ng so-called “partial order methods” for verifying temporal properties of concur rent programs [GW94, Val90]. Another challenging task is to identify subclasses of formu las in LTL(Σ) which have the following property: if a formula is true in one representati ve interleaving of a concurrent run, then it is true in all interleavings.

Though some subset s of LTL(Σ) which have this property have been identiﬁed, the search for a full characte rization of this class is elusive [MT96]. Acknowledgments I thank Deepak D’Souza and P Madhusudan for shedding light on the subtleties of the on-the-ﬂy method. In particular, the dnf based presentation of the [GPVW95] construction is due to Deepak. References [AHU74] A.V. Aho, J.E. Hopcroft and J.D. Ullman: The Design and Analysis of Algorithms , Addison-Wesley, Reading (1974). [Bu60] J.R. B uchi: On a decision method in restricted second order arithmetic, Z.

Math. Logik Grundlag. Math (1960) 66–92 [CVWY92] C. Courcoubetis, M. Vardi, P. Wolper and M. Yannakakis: Memory eﬃcient algorithms for the veriﬁcation of temporal logic pr operties, Formal Methods in System Design 1 (1992) 275–288. Winter School on Logic & Computer Science ISI Calcutta, Dec 1996–Jan 1997

Page 22

M Mukund: LTL and Buchi Automata 21 [DSz96] Deepak D’Souza: On-the-ﬂy techniques for linear time temporal logic, Manuscript (1996). [GPVW95] R. Gerth, D. Peled, M. Vardi and P. Wolper: Simple on-the-ﬂy au- tomatic veriﬁcation of

linear temporal logic, Proc. IFIP/WG6.1 Symp. on Protocol Speciﬁcation, Testing and Veriﬁcation , Warsaw, Poland, June 1995. [GW94] P. Godefroid and P. Wolper: A partial approach to model checking, Inform. and Comput. 110 (1994) 305–326. [Mad96] P. Madhusudan: An on-the-ﬂy algorithm for linear time temporal logic, M.Sc. Thesis , Anna University, Madras, India (1996). [MP91] Z. Manna and A. Pnueli The Temporal Logic of Reactive and Concurrent Systems (Speciﬁcation) , Springer-Verlag, Berlin (1991). [MT96] M. Mukund and P.S. Thiagarajan : Linear time temporal logics

over Mazurkiewicz traces, Proc MFCS ’96 LNCS 1113 (1996) 62–92. [Pnu77] A. Pnueli: The temporal logic of programs, Proc. 18th IEEE FOCS (1977) 46–57. [SVW87] A.P. Sistla, M. Vardi and P. Wolper: Reasoning about inﬁnite compu- tation paths, Proc. 24th IEEE FOCS (1983) 185–194. [Th90] W. Thomas: Automata on inﬁnite objects, in J. van Leeuwen (ed.), Hand- book of Theoretical Computer Science, Volume B , North-Holland, Amsterdam (1990) 133–191. [Th96] W. Thomas: Languages, automata and logic, Report 9607, Institut fur I nfor- matik und Praktische Mathematik,

Christian-Albrechts-Un iversitat, Kiel, Ger- many, May 1996. (Preliminary version of a chapter to appear i n G. Rozenberg, A. Salomaa (eds.), Handbook of Formal Language Theory , Springer-Verlag.) [Val90] A. Valmari : Stubborn sets for reduced state space generation, LNCS 483 (1990) 491–515. [VW86] M. Vardi and P. Wolper: An automata theoretic approach to automatic program veriﬁcation, Proc. 1st IEEE LICS , (1986) 332–345. [VW94] M. Vardi and P. Wolper: Reasoning about inﬁnite computations, Inform. Comput. 115 (1) (1994) 1–37. Winter School on Logic & Computer Science ISI

Calcutta, Dec 1996–Jan 1997

Â© 2020 docslides.com Inc.

All rights reserved.