CTL May Be Ambiguous when Model Checking Moore Machines Cdric Roux - PowerPoint PPT Presentation

CTL May Be Ambiguous when Model Checking Moore Machines Cédric Roux and Emmanuelle Encrenaz Université Pierre et Marie Curie Laboratoire d’Informatique de Paris 6 Architecture des Systèmes Intégrés et Micro−électronique Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003

Modeling versus Verification Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 1

Modeling versus Verification Modeling world Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 1

Modeling versus Verification Modeling world Moore or Mealy machines Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 1

Modeling versus Verification Verification world Modeling world Moore or Mealy machines Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 1

Modeling versus Verification Verification world Kripke structures Modeling world Moore or Mealy machines Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 1

Modeling versus Verification Verification world Translation Kripke structures Modeling world Moore or Mealy machines Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 1

From Moore to Kripke Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 2

From Moore to Kripke i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 2

From Moore to Kripke First translation scheme i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 3

From Moore to Kripke First translation scheme Remove the input signals i i i i i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 3

From Moore to Kripke First translation scheme Remove the input signals i i i i i i Simple Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 3

From Moore to Kripke First translation scheme Remove the input signals i i i i i i Simple Impossible to express properties including input signals Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 3

From Moore to Kripke Second translation scheme a i i b c i i i i e d f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 4

From Moore to Kripke Second translation scheme Input signals into target state of transitions a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 4

From Moore to Kripke Second translation scheme Input signals into target state of transitions a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 Composition of Moore machines lost Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 4

From Moore to Kripke Third translation scheme a i i b c i i i i e d f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 5

From Moore to Kripke Third translation scheme Input signals into source state of transitions a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 5

From Moore to Kripke Third translation scheme Input signals into source state of transitions a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 We can compose Moore machines Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 5

From Moore to Kripke Third translation scheme Input signals into source state of transitions a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 We can compose Moore machines This may introduce ambiguities when using CTL Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 5

Possible CTL ambiguities Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p a i i b c i i i i e d f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying p a i i b c i i i i e d f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying EX p a i i b c i i i i e d f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying AX EX p a i i b c i i i i e d f g Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying p a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying EX p a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying AX EX p a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying AX EX p a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities Checking the property AX EX p states verifying AX EX p a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 «AX EX p does not have the same truth value in both structures» Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 6

Possible CTL ambiguities A first ambiguity Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 7

Possible CTL ambiguities A first ambiguity states verifying EX p a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 7

Possible CTL ambiguities A first ambiguity states verifying EX p a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 States b0 and b1 should verify EX p, as state b does Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 7

Possible CTL ambiguities A first ambiguity states verifying EX p E states verifying EX p i a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 States b0 and b1 should verify EX p, as state b does E We introduce to remove this ambiguity i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 7

Possible CTL ambiguities A second ambiguity Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 8

Possible CTL ambiguities A second ambiguity states verifying AX EX p a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 8

Possible CTL ambiguities A second ambiguity states verifying AX EX p a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 b0 (and b1) should not verify AX EX p, and a0 and a1 should Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 8

Possible CTL ambiguities A second ambiguity states verifying AX EX p A states verifying AX EX p i a0 a1 a i i b c b0 b1 c1 i i i i c0 e d f g g1 e1 g0 d0 d1 e0 f0 f1 b0 (and b1) should not verify AX EX p, and a0 and a1 should A We introduce to remove this ambiguity i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 8

Possible CTL ambiguities A E Checking the property AX EX p i i Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 9

Possible CTL ambiguities A E Checking the property AX EX p i i a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 9

Possible CTL ambiguities A E Checking the property AX EX p i i states verifying p a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 9

Possible CTL ambiguities A E Checking the property AX EX p i i E states verifying EX p i a0 a1 b0 b1 c1 c0 g1 e1 g0 d0 d1 e0 f0 f1 Cédric Roux and Emmanuelle Encrenaz − UPMC LIP6 ASIM CHARME 2003 9