3 COMP 1 5 9 3 Algorithmic Verification LTL Model Checking and - - PowerPoint PPT Presentation

▶
3 comp 1 5 9 3 algorithmic verification
SMART_READER_LITE
LIVE PREVIEW

3 COMP 1 5 9 3 Algorithmic Verification LTL Model Checking and - - PowerPoint PPT Presentation

Aug 18, 2023 96 likes •1.07k views

<latexit

slide-1
SLIDE 1

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

COMP 3 9 1 5 3 Algorithmic Verification

<latexit sha1_base64="P4jUJHo6g1yopyZBD74hiv3LdI=">AIZHicjVRb9NIFD6kXEKW6l4QEhoCBalIa4JYJqVcTSF14QRaIFqanQ2D5xRpnYZjxpG6L8Cn7d/oH9EfvEmWPnRgy7juw5/ubMd75zif1Uq8w2m39fqKxcvHT5SvVq7Y9r12/cvLV6+yhLBibAwyDRifnsywy1ivHQKqvxc2pQ9n2Nn/zevtv/dIomU0n80Q5TPOnLKFYdFUhL0JfVyve2j5GKR1b1vqUqsAOD41o7TkI8zqy0WO8orfd8PcAH2826ULGySuoTsfHV2xSjtsVz63fyNeuM9t+/OxiPx38uMxgMmUD6ySkKo6KuFUln76tHVHqnhGqnOdUJRotU/mok7OfqXZLqHbLqSKDGJeJ0ruOqSw/r5xpiJqkMNWMhOW0Skha5STBUMZzeTmKVl0GAaZWxRGX6fzXdQqNPMubgmGEXIgydGeGuqoXqDeH7paiM4bWHNqa8Z5vFikJacWGV9/yGtNWkMq/dJQYZbt9FYgjNMJZO0Yhwvz9+XWerPR5EsG15hrENxHSrlTa0IYQEAhAHxBisGRrkJDR7xg8aEJK2AmMCDNkKd5HGEONzg7IC8lDEtqjZ0RvxwUa07vjzPh0QFE03YZOCnhc+IRkdxjNVxdfzPn+KsaIuZ3GIa1+wdkn1EKX0P86N/H8v+dcTpYUvuRcFOlMGXFZBgsZdWjV9G5Jv3sOyRPJCumUISsgTBOaIy6GoTWvq8u8y3W7Idk/S4Xd6oH3zj+xGeCaVp9ZjIUzeU9YE15rhLqdCal96yI7mrv8op4x50yhJ3Rvu0zBhzqOMyGsLXrH3K9gj1OmVFNdV8gnj+l28Xo8BYJ3cIFdMCKpFm7f5767majRvfyLaT+cVjPjPFz9keJ70IAW2f1p5IwrH5Bnh+5FBX3OVdHq5n6Zz2lxWZ7R0/VYsJ3MacgonoB97lfM/RAcyXkgc7jpzKvfWMoI4ZS7O2SdlnuC8Iw8M54ZzTmNWK/intf5H6JoR9NOxJ0dwgPKuUkdmuXsVM9nmnKlU45mp3WY/OeQJ6oLQtyd6SB7vtaLyvO6WZ7dfM4Rzum5B4/o7dFvlEw8c0SyJUlZyioM+yZFrfMTuSJTeM5mpgbuW+f9/GVbNo62G97zxvMP2+uv3xRfvSrcg4ewQfPyAl7DWziAQwgq/6Ilc2Vp1f+qV6rlXv5K6VC8WZNVi4qvd/AB3w9Tw=</latexit>

LTL Model Checking and B¨ uchi Automata

  • Dr. Liam O’Connor

CSE, UNSW (for now) Term 1 2020

1

slide-2
SLIDE 2

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking

M | = ϕ

Kripke Structure ??? LTL Formula

2

slide-3
SLIDE 3

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking

M | = ϕ

Kripke Structure ??? LTL Formula

↓ ↓ MA ϕA

B¨ uchi Automaton B¨ uchi Automaton

3

slide-4
SLIDE 4

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking

M | = ϕ

Kripke Structure ??? LTL Formula

↓ ↓ L(MA) ⊆ L(ϕA)

B¨ uchi Automaton B¨ uchi Automaton

4

slide-5
SLIDE 5

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking

M | = ϕ

Kripke Structure ??? LTL Formula

↓ ↓ L(MA) ⊆ L(ϕA)

B¨ uchi Automaton B¨ uchi Automaton B¨ uchi Automata B¨ uchi Automata are like finite automata, but their languages are

  • f infinite-length strings, so they work well for behaviours ∈ (2P)ω.

5

slide-6
SLIDE 6

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Automata

Definition A (generalized) B¨ uchi automaton is a 5-tuple (Q, I, Σ, δ, F) where Q is a set of states. I ⊆ Q is a set of initial states. Σ is our alphabet of actions. δ : (Q × Σ) → 2Q is our transition relation. F ⊆ Q is a set of final states.

6

slide-7
SLIDE 7

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Automata

Definition A (generalized) B¨ uchi automaton is a 5-tuple (Q, I, Σ, δ, F) where Q is a set of states. I ⊆ Q is a set of initial states. Σ is our alphabet of actions. δ : (Q × Σ) → 2Q is our transition relation. F ⊆ Q is a set of final states. Language We consider σ ∈ L(A) for a B¨ uchi automaton A iff it visits a particular final state infinitely often. More formally, define inf(ρ) = { q | q appears infinitely often in ρ }, then we say trace(ρ) ∈ L(A) ⇔ inf(ρ) ∩ F = ∅

7

slide-8
SLIDE 8

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

q0 q1 q2 a c b b a

  • acaaaaaaa. . .

8

slide-9
SLIDE 9

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

q0 q1 q2 a c b b a

  • acaaaaaaa. . .

Accepted

  • acbcbcbcb. . .

9

slide-10
SLIDE 10

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

q0 q1 q2 a c b b a

  • acaaaaaaa. . .

Accepted

  • acbcbcbcb. . .

Accepted

  • acbbbbbbb. . .

10

slide-11
SLIDE 11

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

q0 q1 q2 a c b b a

  • acaaaaaaa. . .

Accepted

  • acbcbcbcb. . .

Accepted

  • acbbbbbbb. . .

Rejected

11

slide-12
SLIDE 12

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Exercise

Let Σ = {0, 1}. Define B¨ uchi automata for the following languages. L1 = {v ∈ Σω | 0 occurs in v exactly once }

12

slide-13
SLIDE 13

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Exercise

Let Σ = {0, 1}. Define B¨ uchi automata for the following languages. L1 = {v ∈ Σω | 0 occurs in v exactly once } L2 = {v ∈ Σω | every 0 is followed at least one 1}

13

slide-14
SLIDE 14

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Exercise

Let Σ = {0, 1}. Define B¨ uchi automata for the following languages. L1 = {v ∈ Σω | 0 occurs in v exactly once } L2 = {v ∈ Σω | every 0 is followed at least one 1} L3 = {v ∈ Σω | v contains infinitely many 1s}

14

slide-15
SLIDE 15

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Exercise

Let Σ = {0, 1}. Define B¨ uchi automata for the following languages. L1 = {v ∈ Σω | 0 occurs in v exactly once } L2 = {v ∈ Σω | every 0 is followed at least one 1} L3 = {v ∈ Σω | v contains infinitely many 1s} L4 = (01)∗Σω

15

slide-16
SLIDE 16

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure Properties

B¨ uchi Automata are closed under: Union (same as NFAs)

16

slide-17
SLIDE 17

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure Properties

B¨ uchi Automata are closed under: Union (same as NFAs) Intersection (as we will show)

17

slide-18
SLIDE 18

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure Properties

B¨ uchi Automata are closed under: Union (same as NFAs) Intersection (as we will show) Complement (as we will refer to textbooks — it’s hard)

18

slide-19
SLIDE 19

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure Properties

B¨ uchi Automata are closed under: Union (same as NFAs) Intersection (as we will show) Complement (as we will refer to textbooks — it’s hard)

19

slide-20
SLIDE 20

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Intersection of GBAs

p0 p1 a a q0 q1 a a

slide-21
SLIDE 21

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Intersection of GBAs

p0 p1 a a q0 q1 a a (p0, q0) (p0, q1) (p1, q0) (p1, q1)

slide-22
SLIDE 22

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Intersection of GBAs

p0 p1 a a q0 q1 a a (p0, q0) (p0, q1) (p1, q0) (p1, q1) a a

slide-23
SLIDE 23

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Intersection of GBAs

p0 p1 a a q0 q1 a a (p0, q0) (p0, q1) (p1, q0) (p1, q1) a a NFA product doesn’t work!

23

slide-24
SLIDE 24

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Triple Product

An accepting cycle of a product of B¨ uchi automata P × Q must cycle through accepting states of both P and Q infinitely often. Arbitrarily, we shall say it must alternate by visiting a final state of Q then P then Q and so on. This doesn’t affect expressivity because we are only concerned with infinite strings.

24

slide-25
SLIDE 25

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Triple Product

An accepting cycle of a product of B¨ uchi automata P × Q must cycle through accepting states of both P and Q infinitely often. Arbitrarily, we shall say it must alternate by visiting a final state of Q then P then Q and so on. This doesn’t affect expressivity because we are only concerned with infinite strings. Key idea Make three copies of the product: P × Q × {0, 1, 2}. Copy ’0’ is marked with initial states IP × IQ. Copy ’2’ is entirely marked as final states. Transition relation like normal product, but:

We move from copy 0 to copy 1 when moving to a state ∈ FQ. We move from copy 1 to copy 2 when moving to a state ∈ FP. All transitions from copy 2 move back to copy 0.

25

slide-26
SLIDE 26

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

slide-27
SLIDE 27

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1

slide-28
SLIDE 28

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

slide-29
SLIDE 29

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

slide-30
SLIDE 30

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a

slide-31
SLIDE 31

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a a

slide-32
SLIDE 32

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a a

slide-33
SLIDE 33

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a a a

slide-34
SLIDE 34

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a a a a

slide-35
SLIDE 35

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a a a a

slide-36
SLIDE 36

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1 p0q0 p0q1 p1q0 p1q1

a a a a a

slide-37
SLIDE 37

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

p0 p1 a a q0 q1 a a

p0q0 p1q1 p0q0 p1q1

a a a a

37

slide-38
SLIDE 38

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Product

Let A1 = (Q1, I1, Σ1, δ1, F1) and A2 = (Q2, I2, Σ2, δ2, F2). Definition Define A∩ with Q = Q1 × Q2 × {0, 1, 2}, and I = I1 × I2 × {0}, Σ = Σ1 ∩ Σ2 and F = Q1 × Q2 × {3}. We define δ as follows:

((q1, q2, 0), a, (q′

1, q′ 2, 0)) ∈ δ

iff (qi, a, q′

i) ∈ δi (i = 1, 2) ∧ q′ 1 /

∈ F1 ((q1, q2, 0), a, (q′

1, q′ 2, 1)) ∈ δ

iff (qi, a, q′

i) ∈ δi (i = 1, 2) ∧ q′ 1 ∈ F1

((q1, q2, 1), a, (q′

1, q′ 2, 1)) ∈ δ

iff (qi, a, q′

i) ∈ δi (i = 1, 2) ∧ q′ 1 /

∈ F2 ((q1, q2, 1), a, (q′

1, q′ 2, 2)) ∈ δ

iff (qi, a, q′

i) ∈ δi (i = 1, 2) ∧ q′ 1 ∈ F2

((q1, q2, 2), a, (q′

1, q′ 2, 0)) ∈ δ

iff (qi, a, q′

i) ∈ δi (i = 1, 2)

38

slide-39
SLIDE 39

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking L(AM) ⊆ L(AΦ)

slide-40
SLIDE 40

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking L(AM) ⊆ L(AΦ) ≡ L(AM) ∩ L(AΦ)C = ∅

slide-41
SLIDE 41

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking L(AM) ⊆ L(AΦ) ≡ L(AM) ∩ L(AΦ)C = ∅ ≡ L(AM) ∩ L(A¬Φ) = ∅

slide-42
SLIDE 42

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking L(AM) ⊆ L(AΦ) ≡ L(AM) ∩ L(AΦ)C = ∅ ≡ L(AM) ∩ L(A¬Φ) = ∅ ≡ L(AM × A¬Φ) = ∅

slide-43
SLIDE 43

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

LTL Model Checking L(AM) ⊆ L(AΦ) ≡ L(AM) ∩ L(AΦ)C = ∅ ≡ L(AM) ∩ L(A¬Φ) = ∅ ≡ L(AM × A¬Φ) = ∅

We still need to know how to: Determine if L(A) = ∅ for a B¨ uchi automaton A. Convert a Kripke structure M to a B¨ uchi automaton AM Convert a LTL formula Φ to a B¨ uchi automaton AΦ.

43

slide-44
SLIDE 44

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi from Kripke

p, q q, s p, r

44

slide-45
SLIDE 45

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi from Kripke

p, q q, s p, r How to convert We add a new initial state, move labels on the states to all incoming edges, and make all states final.

45

slide-46
SLIDE 46

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi from Kripke

p, q q, s p, r How to convert We add a new initial state, move labels on the states to all incoming edges, and make all states final.

{p, q} {q, s} {p, q} {p, r} {p, q}

46

slide-47
SLIDE 47

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Automata Emptiness

Theorem (B¨ uchi pumping) Given a B¨ uchi Automaton A = (Q, I, Σ, δ, F) then L(A) = ∅ iff there exists v, w ∈ Σ∗ with lengths ≤ |Q| such that vwω ∈ L(A).

47

slide-48
SLIDE 48

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Automata Emptiness

Theorem (B¨ uchi pumping) Given a B¨ uchi Automaton A = (Q, I, Σ, δ, F) then L(A) = ∅ iff there exists v, w ∈ Σ∗ with lengths ≤ |Q| such that vwω ∈ L(A). We need to find a final state that is: Reachable from an initial state. Reachable from itself — a cycle.

48

slide-49
SLIDE 49

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Automata Emptiness

Theorem (B¨ uchi pumping) Given a B¨ uchi Automaton A = (Q, I, Σ, δ, F) then L(A) = ∅ iff there exists v, w ∈ Σ∗ with lengths ≤ |Q| such that vwω ∈ L(A). We need to find a final state that is: Reachable from an initial state. Reachable from itself — a cycle. How to detect cycles?

slide-50
SLIDE 50

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

B¨ uchi Automata Emptiness

Theorem (B¨ uchi pumping) Given a B¨ uchi Automaton A = (Q, I, Σ, δ, F) then L(A) = ∅ iff there exists v, w ∈ Σ∗ with lengths ≤ |Q| such that vwω ∈ L(A). We need to find a final state that is: Reachable from an initial state. Reachable from itself — a cycle. How to detect cycles? We use Strongly Connected Components!. Many algorithms exist (see online).

50

slide-51
SLIDE 51

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

How to convert from LTL formulae to B¨ uchi Automata? For atomic formulae, it’s straightforward: p ∧ q

51

slide-52
SLIDE 52

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

How to convert from LTL formulae to B¨ uchi Automata? For atomic formulae, it’s straightforward: p ∧ q {p, q} Σ p ⇒ q

52

slide-53
SLIDE 53

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

How to convert from LTL formulae to B¨ uchi Automata? For atomic formulae, it’s straightforward: p ∧ q {p, q} Σ p ⇒ q {p, q} ¬p Σ We can manually construct them for temporal formulae, but how to do so systematically?

53

slide-54
SLIDE 54

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Methods of LTL to B¨ uchi

Many exist. All are complicated. Tableau Methods (Kersten, Manna, McGuire, Pnueli or Geth, Peled, Vardi, Wolper) Automata Theoretic (Vardi) Local and Eventuality Automata (Vardi, Wolper) Local and Eventuality Automata

1

Reduce number of operators to just UNTIL and X.

54

slide-55
SLIDE 55

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Methods of LTL to B¨ uchi

Many exist. All are complicated. Tableau Methods (Kersten, Manna, McGuire, Pnueli or Geth, Peled, Vardi, Wolper) Automata Theoretic (Vardi) Local and Eventuality Automata (Vardi, Wolper) Local and Eventuality Automata

1

Reduce number of operators to just UNTIL and X.

2

Construct a local automaton for Φ — describes behaviours that satisfy the safety component of Φ.

55

slide-56
SLIDE 56

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Methods of LTL to B¨ uchi

Many exist. All are complicated. Tableau Methods (Kersten, Manna, McGuire, Pnueli or Geth, Peled, Vardi, Wolper) Automata Theoretic (Vardi) Local and Eventuality Automata (Vardi, Wolper) Local and Eventuality Automata

1

Reduce number of operators to just UNTIL and X.

2

Construct a local automaton for Φ — describes behaviours that satisfy the safety component of Φ.

3

Construct a eventuality automaton for Φ — ensures “termination”, the liveness aspect of Φ.

56

slide-57
SLIDE 57

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Methods of LTL to B¨ uchi

Many exist. All are complicated. Tableau Methods (Kersten, Manna, McGuire, Pnueli or Geth, Peled, Vardi, Wolper) Automata Theoretic (Vardi) Local and Eventuality Automata (Vardi, Wolper) Local and Eventuality Automata

1

Reduce number of operators to just UNTIL and X.

2

Construct a local automaton for Φ — describes behaviours that satisfy the safety component of Φ.

3

Construct a eventuality automaton for Φ — ensures “termination”, the liveness aspect of Φ.

4

Intersect the two automata, then reduce the alphabet to just atomic propositions.

57

slide-58
SLIDE 58

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure and Maximal Subsets

Closure The closure Cl(Φ) of an LTL formula Φ is the set of all subformulae of Φ and their negation.

58

slide-59
SLIDE 59

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure and Maximal Subsets

Closure The closure Cl(Φ) of an LTL formula Φ is the set of all subformulae of Φ and their negation. What is the closure of • U • ?

59

slide-60
SLIDE 60

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Closure and Maximal Subsets

Closure The closure Cl(Φ) of an LTL formula Φ is the set of all subformulae of Φ and their negation. What is the closure of • U • ? Maximal Subsets Define Sub(Φ) of an LTL formula Φ as the set of all maximal subsets of Cl(Φ) that are locally consistent (not contradictory).

60

slide-61
SLIDE 61

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Local Automaton

Definition The local automaton for AL

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where: Q = Sub(Φ)

61

slide-62
SLIDE 62

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Local Automaton

Definition The local automaton for AL

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where: Q = Sub(Φ) I = { S ∈ Sub(Φ) | Φ ∈ S }

62

slide-63
SLIDE 63

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Local Automaton

Definition The local automaton for AL

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where: Q = Sub(Φ) I = { S ∈ Sub(Φ) | Φ ∈ S } Σ = 2Cl(Φ)

63

slide-64
SLIDE 64

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Local Automaton

Definition The local automaton for AL

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where: Q = Sub(Φ) I = { S ∈ Sub(Φ) | Φ ∈ S } Σ = 2Cl(Φ) F = I

64

slide-65
SLIDE 65

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Local Automaton

Definition The local automaton for AL

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where: Q = Sub(Φ) I = { S ∈ Sub(Φ) | Φ ∈ S } Σ = 2Cl(Φ) F = I q ∈ δ(p, a) if a = p and

65

slide-66
SLIDE 66

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Local Automaton

Definition The local automaton for AL

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where: Q = Sub(Φ) I = { S ∈ Sub(Φ) | Φ ∈ S } Σ = 2Cl(Φ) F = I q ∈ δ(p, a) if a = p and

  • Xϕ ∈ p

if ϕ ∈ q

  • ϕ U ψ ∈ p

if ψ ∈ p

  • r

ϕ ∈ p ∧ (ϕ U ψ) ∈ q Whats the local automaton for X• ?

66

slide-67
SLIDE 67

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• }

slide-68
SLIDE 68

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • }

slide-69
SLIDE 69

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • }

slide-70
SLIDE 70

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • }

slide-71
SLIDE 71

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • }

slide-72
SLIDE 72

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• }

slide-73
SLIDE 73

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• }

slide-74
SLIDE 74

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• }

slide-75
SLIDE 75

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• }

slide-76
SLIDE 76

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• }

slide-77
SLIDE 77

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

Whats the local automaton for • U • ?

(the edge actions are always just the origin state, so they’re omitted) { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• } { • U • , • , • } { • U • , ¬• , • } { • U • , • , ¬• } { ¬(• U • ), • , ¬• } { ¬(• U • ), ¬• , ¬• }

77

slide-78
SLIDE 78

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Eventuality Automaton

The local automaton accepts just the safety part of our formula. So, our example on the previous slide would accept an infinite sequence of • .

78

slide-79
SLIDE 79

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Eventuality Automaton

The local automaton accepts just the safety part of our formula. So, our example on the previous slide would accept an infinite sequence of • . To ensure that the second part of UNTIL actually happens, we use an eventuality automaton.

79

slide-80
SLIDE 80

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Eventuality Automaton

The local automaton accepts just the safety part of our formula. So, our example on the previous slide would accept an infinite sequence of • . To ensure that the second part of UNTIL actually happens, we use an eventuality automaton. Eventuality Automaton The eventuality automaton AE

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where the states Q are all sets of UNTIL formulae in Cl(Φ), the initial and final state is ∅, the actions Σ are the same as the local automaton Sub(Φ), and δ is defined as follows: q ∈ δ(p, a) iff a is consistent with p and

80

slide-81
SLIDE 81

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Eventuality Automaton

The local automaton accepts just the safety part of our formula. So, our example on the previous slide would accept an infinite sequence of • . To ensure that the second part of UNTIL actually happens, we use an eventuality automaton. Eventuality Automaton The eventuality automaton AE

Φ for a formula Φ is defined as

(Q, I, Σ, δ, F) where the states Q are all sets of UNTIL formulae in Cl(Φ), the initial and final state is ∅, the actions Σ are the same as the local automaton Sub(Φ), and δ is defined as follows: q ∈ δ(p, a) iff a is consistent with p and When p = ∅ : For all (ϕ U ψ) ∈ a one has (ϕ U ψ) ∈ q iff ψ / ∈ a When p = ∅ : For all (ϕ U ψ) ∈ p one has (ϕ U ψ) ∈ q iff ψ / ∈ a

81

slide-82
SLIDE 82

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

The current state of the eventuality automaton reflects the set of UNTIL formulae we are waiting on. Example for • U • : ∅

  • U •
slide-83
SLIDE 83

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

The current state of the eventuality automaton reflects the set of UNTIL formulae we are waiting on. Example for • U • : ∅

  • U •

{ • U • , • , ¬• }

slide-84
SLIDE 84

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

The current state of the eventuality automaton reflects the set of UNTIL formulae we are waiting on. Example for • U • : ∅

  • U •

{ • U • , • , ¬• } { • U • , • , • } { • U • , ¬• , • } { ¬(• U •), • , ¬• } { ¬(• U •), ¬• , ¬• }

slide-85
SLIDE 85

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

The current state of the eventuality automaton reflects the set of UNTIL formulae we are waiting on. Example for • U • : ∅

  • U •

{ • U • , • , ¬• } { • U • , • , • } { • U • , ¬• , • } { ¬(• U •), • , ¬• } { ¬(• U •), ¬• , ¬• } { • U • , ¬• , • } { • U • , • , • }

slide-86
SLIDE 86

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

The current state of the eventuality automaton reflects the set of UNTIL formulae we are waiting on. Example for • U • : ∅

  • U •

{ • U • , • , ¬• } { • U • , • , • } { • U • , ¬• , • } { ¬(• U •), • , ¬• } { ¬(• U •), ¬• , ¬• } { • U • , ¬• , • } { • U • , • , • } { • U • , • , ¬• }

slide-87
SLIDE 87

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Example

The current state of the eventuality automaton reflects the set of UNTIL formulae we are waiting on. Example for • U • : ∅

  • U •

{ • U • , • , ¬• } { • U • , • , • } { • U • , ¬• , • } { ¬(• U •), • , ¬• } { ¬(• U •), ¬• , ¬• } { • U • , ¬• , • } { • U • , • , • } { • U • , • , ¬• } No other consistent edges!

87

slide-88
SLIDE 88

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Alphabet Reduction

Our model automata AM has just atomic propositions for actions, but our formula automaton AL

Φ × AE Φ includes temporal

propositions in the actions.

88

slide-89
SLIDE 89

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Alphabet Reduction

Our model automata AM has just atomic propositions for actions, but our formula automaton AL

Φ × AE Φ includes temporal

propositions in the actions. Solution After computing the product of local and eventuality automata, however, we can simply remove all negations and temporal propositions from the actions, leaving only atomic propositions behind. Then we can compute the final product of our model with our negated formula as normal.

89

slide-90
SLIDE 90

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Complexity

Each node in a local automaton contains each subformula,

90

slide-91
SLIDE 91

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Complexity

Each node in a local automaton contains each subformula, |Q| exponential in size of formula. Eventuality automata has each combination of UNTILs,

91

slide-92
SLIDE 92

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Complexity

Each node in a local automaton contains each subformula, |Q| exponential in size of formula. Eventuality automata has each combination of UNTILs, |Q| exponential in number of UNTILs. Then product, reduction to reachable states, alphabet reduction, and final product.

92

slide-93
SLIDE 93

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Complexity

Each node in a local automaton contains each subformula, |Q| exponential in size of formula. Eventuality automata has each combination of UNTILs, |Q| exponential in number of UNTILs. Then product, reduction to reachable states, alphabet reduction, and final product. Then SCCs to find cycles, check emptiness.

93

slide-94
SLIDE 94

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Complexity

Each node in a local automaton contains each subformula, |Q| exponential in size of formula. Eventuality automata has each combination of UNTILs, |Q| exponential in number of UNTILs. Then product, reduction to reachable states, alphabet reduction, and final product. Then SCCs to find cycles, check emptiness. Tons of overhead. Other methods are smarter (but even more complicated).

94

slide-95
SLIDE 95

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

SPIN

Liam: Whirlwind tour of SPIN, preview of next lecture 95

slide-96
SLIDE 96

B¨ uchi Automata LTL Model Checking LTL to B¨ uchi Automata

Bibliography

Baier/Katoen: Principles of Model Checking, Section 5.2

96