tree automata approximations and constraints for
play

Tree Automata, Approximations, and Constraints for Verification - PowerPoint PPT Presentation

Tree Automata, Approximations, and Constraints for Verification Ph.D. thesis defence for Vincent Hugot , Supervised by O. Kouchnarenko and P.-C. Ham {pheam,vhugot,okouchna}@femto-st.fr University of Franche-Comt DGA & Inria/CASSIS &


  1. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Model-Checking LTL on Rewrite Sequences 1 Statement of the Central Problem Our Approach: An Overview TAGE With a Bounded Number of Constraints 2 Global Equality Constraints Overview of the Results Other Works and Some Perspectives 3 Results on SAT & Tree-Walking Automata Perspectives and Questions Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 8 / 24

  2. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 R , Π | = ¬ X : “The first transition, if it occurs, is not by X ” π 1 ≡ X ( Π ) = ∅ Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  3. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : “The first transition, if it occurs, is not by X ” π 1 ≡ X ( Π ) = ∅ 2 X : “There is a first transition, and it is by X ” π 2 ≡ [ R \ X ]( Π ) = ∅ ? Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  4. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : “The first transition, if it occurs, is not by X ” π 1 ≡ X ( Π ) = ∅ 2 X : “There is a first transition, and it is by X ” π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  5. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : “The first transition, if it occurs, is not by X ” π 1 ≡ X ( Π ) = ∅ 2 X : “There is a first transition, and it is by X ” π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : “No transition that occurs is by X ” π 3 ≡ X ( R ∗ ( Π )) = ∅ Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  6. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : “No transition that occurs is by X ” π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : “All transitions that occur are by X ” Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  7. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : “No transition that occurs is by X ” π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : “All transitions that occur are by X ” π 4 ≡ π 2 [ R ∗ ( Π ) /Π ] ≡ [ R \ X ]( R ∗ ( Π )) = ∅ ∧ R ∗ ( Π ) ⊆ X − 1 ( T ) ? Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  8. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : “No transition that occurs is by X ” π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : “All transitions that occur are by X ” π 4 ≡ π 2 [ R ∗ ( Π ) /Π ] ≡ [ R \ X ]( R ∗ ( Π )) = ∅ ∧ R ∗ ( Π ) ⊆ X − 1 ( T ) ? ω -language! Too strong Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  9. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : “No transition that occurs is by X ” π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : “All transitions that occur are by X ” π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  10. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 4 � X : 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . ϕ : π = “ R , Π | = ϕ is translated by π ” “for all executions, ϕ is satisfied” ∀ x.P ( x ) ∧ ∀ x.Q ( x ) ⇐ ⇒ ∀ x. ( P ( x ) ∧ Q ( x )) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  11. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 4 � X : 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . ∀ x.P ( x ) ∧ ∀ x.Q ( x ) ⇐ ⇒ ∀ x. ( P ( x ) ∧ Q ( x )) 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = ∀ x.P ( x ) ∨ ∀ x.Q ( x ) = ⇒ ∀ x. ( P ( x ) ∨ Q ( x )) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  12. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : ∧ Π ⊆ X − 1 ( T ) π 2 ≡ [ R \ X ]( Π ) = ∅ 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 4 � X : 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . ∀ x.P ( x ) ∧ ∀ x.Q ( x ) ⇐ ⇒ ∀ x. ( P ( x ) ∧ Q ( x )) 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = ∀ x.P ( x ) ∨ ∀ x.Q ( x ) = ⇒ ∀ x. ( P ( x ) ∨ Q ( x )) 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = ∀ x. ¬ P ( x ) � = ¬∀ x.P ( x ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  13. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  14. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  15. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) X : π 2 , Y : π ′ 2 ≡ π 2 [ Y/X ] , π 7 ≡ π ′ 2 [ X ( Π ) /Π ] Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  16. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) X : π 2 , Y : π ′ 2 ≡ π 2 [ Y/X ] , π 7 ≡ π ′ 2 [ X ( Π ) /Π ] Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  17. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) X : π 2 , Y : π ′ 2 ≡ π 2 [ Y/X ] , π 7 ≡ π ′ 2 [ X ( Π ) /Π ] Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  18. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) X : π 2 , Y : π ′ 2 ≡ π 2 [ Y/X ] , π 7 ≡ π ′ 2 [ X ( Π ) /Π ] � ( X ⇒ • Y ) : π 0 ≡ π 7 [ R ∗ ( Π ) /Π ] Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  19. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) X : π 2 , Y : π ′ 2 ≡ π 2 [ Y/X ] , π 7 ≡ π ′ 2 [ X ( Π ) /Π ] � ( X ⇒ • Y ) : π 0 ≡ π 7 [ R ∗ ( Π ) /Π ] What about • Y ⇒ X ? Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  20. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation 1 ¬ X : π 1 ≡ X ( Π ) = ∅ 2 X : π 2 ≡ [ R \ X ]( Π ) = ∅ ∧ Π ⊆ X − 1 ( T ) 3 � ¬ X : π 3 ≡ X ( R ∗ ( Π )) = ∅ ≡ π 1 [ R ∗ ( Π ) /Π ] 4 � X : π 4 ≡ [ R \ X ]( R ∗ ( Π )) = ∅ 5 Conjunction: if ϕ : π 5 and ψ : π ′ 5 then ϕ ∧ ψ : π 5 ∧ π ′ 5 . 6 Disjunction: π 6 ∨ π ′ ⇒ R , Π | = ϕ ∨ ψ 6 = 7 Negation: R , Π | / ϕ � = R , Π | = ¬ ϕ : “NNF” required = 8 Implication: X ⇒ • Y : π 7 ≡ [ R \ Y ]( X ( Π )) = ∅ ∧ X ( Π ) ⊆ Y − 1 ( T ) X : π 2 , Y : π ′ 2 ≡ π 2 [ Y/X ] , π 7 ≡ π ′ 2 [ X ( Π ) /Π ] � ( X ⇒ • Y ) : π 0 ≡ π 7 [ R ∗ ( Π ) /Π ] What about • Y ⇒ X ? Other techniques (signatures,. . . ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 9 / 24

  21. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Translation Rules, by Examples A dozen rules, e.g. conjunction: � Π � σ � ϕ ∧ ψ � � � Π � σ � ϕ � ∧ � Π � σ � ψ � always (simplest case): � Π � ε � � ϕ � � � R ∗ ( Π ) � ⋆ ε � ϕ � positive literal: � � Π � σ � X � ( σ \ X ) ⊳ � h ( σ \ X ) = ε h ( σ \ X )− 1 � h ( σ \ X ) � � Π k σ \ X ⊆ R − 1 ( T ) = ∅ Π ∧ σ \ X k ∈ ∇ σ,k = 0 Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 10 / 24

  22. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References LTL → Rewrite Proposition Derivation Tree Derivation tree: automatic translation and proof � � Π � ε � � ( X ⇒ • Y ) � � � R ∗ ( Π ) � ⋆ ε � X ⇒ • Y � � � R ∗ ( Π ) � � X � R | N 1 � � • Y � � � R ∗ ( Π ) � � X � R | N 1 � � ◦ Y � ∧ X ( R ∗ ( Π )) ⊆ R − 1 ( T ) . � � X ( R ∗ ( Π )) � ⋆ ε � Y � [ R \ Y ]( X ( R ∗ ( Π ))) = ∅ Optional global optimisation phase: R − 1 ( T ) → Y − 1 ( T ) . Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 11 / 24

  23. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Translatable Fragment Exactly rewrite-translatable fragment: X ∈ ℘ ( R ) , m ∈ N ϕ : = ⊤ | ⊥ | X | ¬ X | ϕ ∧ ϕ | ψ ⇒ ϕ | • ϕ | ◦ ϕ | � ϕ ψ : = ⊤ | ⊥ | X | ¬ X | ψ ∨ ψ | ψ ∧ ψ | • ψ | ◦ ψ | Φ Φ : = at least ε -stabilisable � ϕ Practical pre-experimental evaluation: good partial support of [Dwyer et al., 1999] patterns. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 12 / 24

  24. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References LTL on Rewrite Sequences Perspectives (Translation Into Rewrite Proposition) R Π ϕ δ 1 , . . . , δ n π To Rew. Prop. To Approx. R , Π | = ϕ ? [Héam et al., 2012a] Int. Conf. IJCAR’12, Manchester Extensions : Past-Time and Existential LTL Dealing with eventuality by studying “exhaustion”: e.g. ♦ ¬ { f ( x ) → x } holds with bounded f -height & no intro Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 13 / 24

  25. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References LTL on Rewrite Sequences Perspectives (Approximated Decision Procedures) R Π ϕ δ 1 , . . . , δ n π To Rew. Prop. To Approx. = ϕ ? R , Π | Coping with more non-linearity – e.g. protocols, rewrite steps e.g. f ( x, x ) → g ( x ) , f ( x ) → g ( x, x ) ,. . . Tractable algorithmic toolbox for TAGE Last points ⇒ closer study of TAGE complexity Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 14 / 24

  26. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Model-Checking LTL on Rewrite Sequences 1 Statement of the Central Problem Our Approach: An Overview TAGE With a Bounded Number of Constraints 2 Global Equality Constraints Overview of the Results Other Works and Some Perspectives 3 Results on SAT & Tree-Walking Automata Perspectives and Questions Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 14 / 24

  27. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] TAGE, TA = , Positive TAGED, A = � A , Q, F, ∆, ≅ � : � A , Q, F, ∆ � vanilla tree automaton ta ( A ) ≅ equality constraints , ≅ ⊆ Q 2 Constraint p ≅ q : run ρ of A on t : run of ta ( A ) on t satisfying ≅ : ∀ α, β ∈ P ( t ) ; ρ ( α ) ≅ ρ ( β ) ⇒ t | α = t | β accepting run : accepting for ta ( A ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 15 / 24

  28. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] q ≅ ^ A = { a/ 0 , f/ 2 } , Q = { q, ^ q, q f } , F = { q f } , ^ q , and ∆ = { f (^ q, ^ q ) → q f , f ( q, q ) → q, f ( q, q ) → ^ q, a → q, a → ^ q } u = f and v = f f f f a a a a a a a Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 16 / 24

  29. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] q ≅ ^ A = { a/ 0 , f/ 2 } , Q = { q, ^ q, q f } , F = { q f } , ^ q , and ∆ = { f (^ q, ^ q ) → q f , f ( q, q ) → q, f ( q, q ) → ^ q, a → q, a → ^ q } u, ρ u = f q f and v = f f ^ f ^ f a q q a q a q a q a q a a Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 16 / 24

  30. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] q ≅ ^ A = { a/ 0 , f/ 2 } , Q = { q, ^ q, q f } , F = { q f } , ^ q , and ∆ = { f (^ q, ^ q ) → q f , f ( q, q ) → q, f ( q, q ) → ^ q, a → q, a → ^ q } u = f and v, ρ v = f q f f f f ^ a ^ q q a a a a a q a q Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 16 / 24

  31. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Model-Checking LTL on Rewrite Sequences 1 Statement of the Central Problem Our Approach: An Overview TAGE With a Bounded Number of Constraints 2 Global Equality Constraints Overview of the Results Other Works and Some Perspectives 3 Results on SAT & Tree-Walking Automata Perspectives and Questions Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 16 / 24

  32. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References TA = versus TA = k Restriction on the kind of constraints: Rigid Automata (RTA) Same expressive power as TA = Less compact representations Linear emptiness / finiteness tests, vs. ExpTime -complete Applications: [Jacquemard et al., 2009, Vacher, 2010] What of the number of constraints? TA = k A = � Σ, Q, F, ∆, ≅ � : TA = A � Σ, Q, F, ∆, ≅ � ≅ such that Card ( ≅ ) � k Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 17 / 24

  33. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Summary of Results [Héam et al., 2012c] Int. Conf. CIAA’12, Porto Strict hierarchy of powers: L ( TA = k ) ⊂ L ( TA = k + 1 ) Emptiness linear for TA = 1 , ExpTime-complete TA = 2 Finiteness polynomial for TA = 1 , ExpTime-complete for TA = 2 NP-complete membership becomes polynomial if k fixed. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 18 / 24

  34. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Summary of Results [Héam et al., 2012c] Int. Conf. CIAA’12, Porto Strict hierarchy of powers: L ( TA = k ) ⊂ L ( TA = k + 1 ) σ u i ∈ T ( A i ) ∀ i u k u k σ u k − 1 u k − 1 σ u 1 u 1 ⊥ , Emptiness linear for TA = 1 , ExpTime-complete TA = 2 Finiteness polynomial for TA = 1 , ExpTime-complete for TA = 2 NP-complete membership becomes polynomial if k fixed. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 18 / 24

  35. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Summary of Results [Héam et al., 2012c] Int. Conf. CIAA’12, Porto Strict hierarchy of powers: L ( TA = k ) ⊂ L ( TA = k + 1 ) Emptiness linear for TA = 1 , ExpTime-complete TA = 2 . . . u n σ σ σ σ u n − 1 σ u 1 u 2 u 3 . . . σ σ σ σ u u u u u Finiteness polynomial for TA = 1 , ExpTime-complete for TA = 2 NP-complete membership becomes polynomial if k fixed. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 18 / 24

  36. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Summary of Results [Héam et al., 2012c] Int. Conf. CIAA’12, Porto Strict hierarchy of powers: L ( TA = k ) ⊂ L ( TA = k + 1 ) Emptiness linear for TA = 1 , ExpTime-complete TA = 2 Finiteness polynomial for TA = 1 , ExpTime-complete for TA = 2 Reduction of emptiness to finiteness. NP-complete membership becomes polynomial if k fixed. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 18 / 24

  37. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Summary of Results NP-complete membership becomes polynomial if k fixed. − h ∈ H t ← P − → G P S t • • • G 1 = { p, q } C G 1 C G 1 G 2 = { r, s, t } C G 3 • • • • C G 2 G 3 = { q x } . . . • • • • • • • • C G n G n Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 18 / 24

  38. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Model-Checking LTL on Rewrite Sequences 1 Statement of the Central Problem Our Approach: An Overview TAGE With a Bounded Number of Constraints 2 Global Equality Constraints Overview of the Results Other Works and Some Perspectives 3 Results on SAT & Tree-Walking Automata Perspectives and Questions Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 18 / 24

  39. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References TAGE SAT & Tree-Walking Overloops [Héam et al., 2010] Int. Workshop CSTVA’10, Paris [Héam et al., 2011] Int. Conf. CIAA’11, Blois [Héam et al., 2012b] Int. Journal Theo. Comp. Sci. SAT Encoding for TAGE membership & optimisations. Formal treatment of tree-walking loops for transformation into bottom-up TA; revealed missing factor in space Σ × T × 2 Q 2 . Introduced tree-walking overloops : restores T × 2 Q 2 , smaller automata in practice in extensive random tests. Shown overloops upper-bound is | T | · 2 | Q | log 2 ( | Q | + 1 ) in the deterministic case. Note that exponential is unavoidable. Polynomial overloops-based approximation to TWA emptiness, vs. ExpTime -c. Very precise in random tests. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 19 / 24

  40. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Polynomial Approximation for Emptiness Random tests 1 Ad-hoc scheme: ≈ 20 000 TWA, 2 � | Q | � 20 , | ∆ | ≈ 3 × | Q | , 75 % of empty languages, only two Unknown instead of Empty . 2 Uniform scheme [Héam et al., 2009], REGAL back-end for FSA generation [Bassino et al., 2007]. 2 000 deterministic and complete TWA uniformly generated for each 2 � | Q | � 25 . Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 20 / 24

  41. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Polynomial Approximation for Emptiness Random tests 55 Approximation – 2000 samples Approximation – 200 samples 50 Exact – 200 samples 45 40 35 30 ∅ % 25 20 15 10 5 0 2 4 6 8 10 12 14 16 18 20 22 24 | Q | Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 20 / 24

  42. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Size Comparison: Loops vs. Overloops One Example & Uniform Generation Scheme For X : loops � B l � = 1986 ; overloops � B o � = 95 ; deterministic minimal � B m � = 56 ; smallest known non-deterministic � B s � = 34 . Loops 60 times worse than manual optimal; overloops 3 times . � = 1617 , � B ′ � � B ′ � o � = 78 . Orthogonal to post-processing cleanup: l � � B ′ � � B l � � B l � � ≈ � B o � l � � B o � ≈ 20.9 o � ≈ 20.7 o � ≈ 1.2 . and and � B ′ � � B ′ � � B ′ l Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 21 / 24

  43. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Size Comparison: Loops vs. Overloops One Example & Uniform Generation Scheme 18 � B l � � B l � / � B o � 16 � B ′ l � (clean) � B ′ l � / � B ′ o � � B o � � B l � / � B ′ l � � B ′ � B o � / � B ′ 14 3 o � (clean) o � 12 10 5 10 Ratio 2 � B � � 8 6 1 4 2 70 2 3 4 5 6 7 2 3 4 5 6 | Q A | | Q A | Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 21 / 24

  44. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Model-Checking LTL on Rewrite Sequences 1 Statement of the Central Problem Our Approach: An Overview TAGE With a Bounded Number of Constraints 2 Global Equality Constraints Overview of the Results Other Works and Some Perspectives 3 Results on SAT & Tree-Walking Automata Perspectives and Questions Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 21 / 24

  45. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Conclusion / Summary Generalisation of the translation R Π ϕ δ 1 , . . . , δ n π To Rew. Prop. To Approx. R , Π | = ϕ ? Study of complexity of bounded global constraints Improved loops-based methods for tree-walking automata Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 22 / 24

  46. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Perspectives Full TAGE may not be required for X ( Π ) ; flat constraints ensure polynomial emptiness decision; are they enough? Implemented algorithmic toolbox for these automata. Rewrite propositions go beyond LTL (e.g. ∃ -LTL). What is their full expressive power ? Intermix state and transition -based properties. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 23 / 24

  47. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Questions ? Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 24 / 24

  48. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Supported Fragment, In Practice Partially Supported Patterns From [Dwyer et al., 1999] Scope Pattern Global Before After Between Until Support Absence 41 5 12 18 9 48% Universality 110 1 5 2 1 96% Existence 12 1 4 8 1 0% Bound Exist. 0 0 0 1 0 0% Response 241 1 3 0 0 99% Precedence 25 0 1 0 0 96% Resp. Chain 8 0 0 0 0 0% Prec. Chain 1 0 0 0 0 0% Support 95% 0% 32% 0% 0% 83% Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 25 / 24

  49. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Formal Tools for Verification Reliable Software Software failure is undesirable . . . Ariane 5, Therac-25, Mariner I, Phobos I, XA/21 USA & Canada Northeast 2003 blackout, MIM-104 Patriot anti-missile, Mars Climate Orbiter, Mars Polar Lander, Mars Global Surveyor space probes,. . . . . . hence the need for formal verification methods. E.G. With Hoare logic , correctness is a mathematical theorem. Precondition, code, post-condition: { ⊤ } x : = y { x = y } . Manual proofs require mathematical ingenuity. Automation ? Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 26 / 24

  50. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Model-Checking Rewrite Sequences Coding the Behaviour of the System: � ( X ⇒ • Y ) X r ′ i ∈ Y r i ∈ X u i v i t i R ∗ r ′ j ∈ Y r j ∈ X u j v j t j R ∗ X t 0 ∈ Π X r ′ k ∈ Y r k ∈ X R ∗ . . . . . . . . . r ′ n ∈ Y r n ∈ X R ∗ t n u n v n X Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 27 / 24

  51. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Maximal Rewrite Words Coding the Behaviour of the System X r ′ i ∈ Y r i ∈ X t i u i v i R ∗ r ′ j ∈ Y r j ∈ X t j u j v j R ∗ X t 0 ∈ Π X r ′ k ∈ Y r k ∈ X R ∗ . . . . . . . . . r ′ r n ∈ X n ∈ Y R ∗ u n v n t n X Executions may or may not terminate : finite and infinite words. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 28 / 24

  52. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Maximal Rewrite Words Coding the Behaviour of the System Finite or infinite words on R : � � � 1, n � → R � N = N ∪ { + ∞ } W = n ∈ N Notation: length # w ∈ N : # w = Card ( dom w ) . Maximal rewrite words of R , originating in Π : � Π � is the set of words w ∈ W such that ∃ u 0 ∈ Π : ∃ u 1 , . . . , u # w ∈ T : ∀ k ∈ dom w, w ( k ) → u k ∧ # w ∈ N ⇒ R ( { u # w } ) = ∅ u k − 1 − − − Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 28 / 24

  53. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Syntax and Semantics for LTL Close to Finite-LTL [Manna and Pnueli, 1995] ϕ : = X | ¬ ϕ | ϕ ∧ ϕ | • m ϕ | ◦ m ϕ | ϕ U ϕ X ∈ ℘ ( R ) ⊤ | ⊥ | ϕ ∨ ϕ | ϕ ⇒ ϕ | ♦ ϕ | � ϕ m ∈ N . ⇔ ( w, i ) | = X i ∈ dom w and w ( i ) ∈ X ( w, i ) | = ¬ ϕ ⇔ ( w, i ) | / ϕ = ⇔ ( w, i ) | = ( ϕ ∧ ψ ) ( w, i ) | = ϕ and ( w, i ) | = ψ = • m ϕ ( w, i ) | ⇔ i + m ∈ dom w and ( w, i + m ) | = ϕ = ◦ m ϕ ( w, i ) | ⇔ i + m / ∈ dom w or ( w, i + m ) | = ϕ � ∃ j ∈ dom w : j � i ∧ ( w, j ) | = ψ ( w, i ) | = ϕ U ψ ⇔ ∧ ∀ k ∈ � i, j − 1 � , ( w, k ) | = ϕ For any w ∈ W , i ∈ N 1 , m ∈ N and X ∈ ℘ ( R ) . Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 29 / 24

  54. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Syntax and Semantics for LTL Close to Finite-LTL [Manna and Pnueli, 1995] ϕ : = X | ¬ ϕ | ϕ ∧ ϕ | • m ϕ | ◦ m ϕ | ϕ U ϕ X ∈ ℘ ( R ) ⊤ | ⊥ | ϕ ∨ ϕ | ϕ ⇒ ϕ | ♦ ϕ | � ϕ m ∈ N . ( w, i ) | = X ⇔ i ∈ dom w and w ( i ) ∈ X ⇔ ( w, i ) | = ¬ ϕ ( w, i ) | / ϕ = ( w, i ) | = ( ϕ ∧ ψ ) ⇔ ( w, i ) | = ϕ and ( w, i ) | = ψ = • m ϕ ⇔ ( w, i ) | i + m ∈ dom w and ( w, i + m ) | = ϕ = ◦ m ϕ ( w, i ) | ⇔ i + m / ∈ dom w or ( w, i + m ) | = ϕ ⇔ ∀ j ∈ dom w, j � i ⇒ ( w, j ) | ( w, i ) | = � ϕ = ϕ For any w ∈ W , i ∈ N 1 , m ∈ N and X ∈ ℘ ( R ) . Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 29 / 24

  55. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Syntax and Semantics for LTL Close to Finite-LTL [Manna and Pnueli, 1995] ( w, i ) | ⇔ i ∈ dom w and w ( i ) ∈ X = X ( w, i ) | = ¬ ϕ ⇔ ( w, i ) | / ϕ = ⇔ = ϕ and ( w, i ) | ( w, i ) | = ( ϕ ∧ ψ ) ( w, i ) | = ψ = • m ϕ ( w, i ) | ⇔ i + m ∈ dom w and ( w, i + m ) | = ϕ = ◦ m ϕ ⇔ ( w, i ) | i + m / ∈ dom w or ( w, i + m ) | = ϕ ( w, i ) | = � ϕ ⇔ ∀ j ∈ dom w, j � i ⇒ ( w, j ) | = ϕ For any w ∈ W , i ∈ N 1 , m ∈ N and X ∈ ℘ ( R ) . Satisfaction: = ϕ ⇐ ⇒ ( w, 1 ) | w | = ϕ R , Π | = ϕ ⇐ ⇒ ∀ w ∈ � Π � , w | = ϕ Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 29 / 24

  56. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Rewrite Propositions Problem Statement: First Translation Step Rewrite proposition π on R , from Π ; has a trivial truth value γ : = ℓ = ∅ | ℓ ⊆ ℓ π : = γ | γ ∧ γ | γ ∨ γ ℓ : = Π | T | X ( ℓ ) | X − 1 ( ℓ ) | X ∗ ( ℓ ) X ∈ ℘ ( R ) Problem statement : translations into RP Input: R , ϕ ∈ LTL, Π ⊆ T Output: RP π such that: R , Π | = ϕ ⇐ ⇒ π (exact translation) R , Π | = ϕ ⇐ = π (under-approximated translation) R , Π | = ϕ = ⇒ π ( over-approximated translation ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 30 / 24

  57. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Intuitions for the Translation Boundaries of the Translatable Fragment R ∗ ( Π ) hides traces : ♦ X probably untranslatable. So are { ♦ , U , W , R , . . . } . Formulæ in sanitised form : negation on literals. Not exactly NNF. ( A ∨ B ) ⇒ C ( A ⇒ C ) ∧ ( B ⇒ C ) ( ¬ A ∧ ¬ B ) ∨ C Preprocessing to fit translatable “antecedent/consequent” form. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 31 / 24

  58. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Signatures Implication: Girdling the Future Idea: ϕ ⇒ ψ ? ϕ as an assumption , i.e. a model of ϕ : ξ ( ϕ ) �� � � � 1, n � ∪ { ω } � Σ = → ℘ ( R ) × ℘ ( N ) . n ∈ N Notations: σ ∈ Σ compactly as σ = � f | S � = � ∂σ | ∇ σ � , or in extenso as � f ( 1 ) , f ( 2 ) , . . . , f ( # σ ) � f ( ω ) | S � . X ∧ ◦ 1 Y ∧ ◦ 2 � Z � � Example: ξ = � X, Y � Z | N 1 � Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 32 / 24

  59. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Signatures Implication: Girdling the Future �� � � � Σ = � 1, n � ∪ { ω } → ℘ ( R ) × ℘ ( N ) . n ∈ N Notations: σ ∈ Σ compactly as σ = � f | S � = � ∂σ | ∇ σ � , or in extenso as � f ( 1 ) , f ( 2 ) , . . . , f ( # σ ) � f ( ω ) | S � . X ∧ ◦ 1 Y ∧ ◦ 2 � Z � � Example: ξ = � X, Y � Z | N 1 � Constrained Words: � Π � σ � = { w ∈ � Π � | # w ∈ ∇ σ ∧ ∀ k ∈ dom w, w ( k ) ∈ σ [ k ] } ∀ Π ⊆ T , ϕ ∈ A -LTL , � Π � ξ ( ϕ ) � = { w ∈ � Π � | w | = ϕ } Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 32 / 24

  60. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Signatures: the Transformation ξ ( · ) Modelling the Antecedent to Girdle the Future ξ ( ⊥ ) = �� ∅ | ∅ � ξ ( ⊤ ) = �� R | N � = ε ξ ( X ) = � X � R | N 1 � ξ ( ¬ X ) = � R \ X � R | N � ξ ( • m ϕ ) = ξ ( ϕ ) ◮ m ξ ( ◦ m ϕ ) = ξ ( ϕ ) ⊲ m ∞ � � � ξ ( ϕ ∧ ψ ) = ξ ( ϕ ) � ξ ( ψ ) ξ ( � ϕ ) = ξ ( ϕ ) ⊲ m m = 0 Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 33 / 24

  61. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Signatures: the Transformation ξ ( · ) Modelling the Antecedent to Girdle the Future ξ ( ⊥ ) = �� ∅ | ∅ � ξ ( ⊤ ) = �� R | N � = ε ξ ( X ) = � X � R | N 1 � ξ ( ¬ X ) = � R \ X � R | N � ξ ( • m ϕ ) = ξ ( ϕ ) ◮ m ξ ( ◦ m ϕ ) = ξ ( ϕ ) ⊲ m ∞ � � � ξ ( ϕ ∧ ψ ) = ξ ( ϕ ) � ξ ( ψ ) ξ ( � ϕ ) = ξ ( ϕ ) ⊲ m m = 0 σ ◮ m = Strong Shift Right = � R 1 , . . . , R m , ∂σ ( 1 ) , . . . , ∂σ ( # σ ) � ∂σ ( ω ) | ( ∇ σ \ { 0 } ) + m � σ ⊲ m = Weak Shift Right = � R 1 , . . . , R m , ∂σ ( 1 ) , . . . , ∂σ ( # σ ) � ∂σ ( ω ) | � 0, m � ∪ ( ∇ σ + m ) � Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 33 / 24

  62. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Signatures: the Transformation ξ ( · ) Modelling the Antecedent to Girdle the Future ξ ( ⊥ ) = �� ∅ | ∅ � ξ ( ⊤ ) = �� R | N � = ε ξ ( X ) = � X � R | N 1 � ξ ( ¬ X ) = � R \ X � R | N � ξ ( • m ϕ ) = ξ ( ϕ ) ◮ m ξ ( ◦ m ϕ ) = ξ ( ϕ ) ⊲ m ∞ � � � ξ ( ϕ ∧ ψ ) = ξ ( ϕ ) � ξ ( ψ ) ξ ( � ϕ ) = ξ ( ϕ ) ⊲ m m = 0 Product Property: � Π � σ � σ ′ � = � Π � σ � ∩ � Π � σ ′ � ρ = � X ′ � Z ′ | N 3 � Example: σ = � X, Y � Z | N 2 � σ � ρ = � X ∩ X ′ , Y ∩ Z ′ � Z ∩ Z ′ | N 3 � Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 33 / 24

  63. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Signatures: the Transformation ξ ( · ) Modelling the Antecedent to Girdle the Future ξ ( ⊥ ) = �� ∅ | ∅ � ξ ( ⊤ ) = �� R | N � = ε ξ ( X ) = � X � R | N 1 � ξ ( ¬ X ) = � R \ X � R | N � ξ ( • m ϕ ) = ξ ( ϕ ) ◮ m ξ ( ◦ m ϕ ) = ξ ( ϕ ) ⊲ m ∞ � � � ξ ( ϕ ∧ ψ ) = ξ ( ϕ ) � ξ ( ψ ) ξ ( � ϕ ) = ξ ( ϕ ) ⊲ m m = 0 ∞ ∞ ∞ � � � ◦ m ϕ � ϕ ⇔ � Π � σ n � = � Π � σ n � m = 0 n = 0 n = 0 ∞ ∞ � � � � � � σ ◮ n and σ ⊲ n converge ∀ σ ∈ Σ n = 0 n = 0 Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 33 / 24

  64. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Rewrite Proposition → Procedure automatic kind inference and generation rules Kind inference: expressiveness required & assumptions α : TA ⊢ X ( α ) : TA = ⊳ α : TA , X : reg-pres ⊢ X ( α ) : TA ⊢ X − 1 ( T ) : TA = ⊳ X : left-lin ⊢ X − 1 ( T ) : TA α : TA = ⊢ ♮ α : TA , ♮ α : + α : TA ⊢ ♮ α : TA + + Procedure Generation: from languages to automata Γ � X − 1 ( T ) ⇒ Γ, � X : left-lin � � X − 1 ( T ) Γ � [ ℓ ֌ ∆, α ] � ∆ ⊢ ∗ α : TA � X ( ℓ ) ⇒ Γ, ∆, � X : reg-pres � � X ( α ) Γ � [ ℓ ֌ ∆, α ] � ∆ ⊢ ∗ α : TA = � X ( ℓ ) ⇒ Γ, ∆, � X : reg-pres � � X ( ♮ α ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 34 / 24

  65. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Supported Fragment, In Practice Partially Supported Patterns From [Dwyer et al., 1999] Scope Pattern Global Before After Between Until Support Absence 41 5 12 18 9 48% Universality 110 1 5 2 1 96% Existence 12 1 4 8 1 0% Bound Exist. 0 0 0 1 0 0% Response 241 1 3 0 0 99% Precedence 25 0 1 0 0 96% Resp. Chain 8 0 0 0 0 0% Prec. Chain 1 0 0 0 0 0% Support 95% 0% 32% 0% 0% 83% Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 35 / 24

  66. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata [Comon et al., 2008] Introduced in the fifties; regular tree languages : model-checking: programs, protocols,. . . automated theorem-proving XML schema and (esp. variants) query languages . . . and so much more Doesn’t deal with comparisons and non-linearity : { f ( u, u ) | u ∈ T ( Σ ) } e.g. password verification { f ( u, v ) | u, v ∈ T ( Σ ) , u � = v } e.g. primary keys R ( ℓ ) , ℓ regular, R a TRS e.g. { g ( x ) → f ( x, x ) } ( T ( A )) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 36 / 24

  67. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata Bottom-Up, Non-Deterministic, Finite Tree Automaton A = � A , Q, F, ∆ � : finite ranked alphabet A Q finite set of states F final states, F ⊆ Q ∆ finite set of transitions Transition r ∈ ∆ : σ ( q 1 , . . . , q n ) → q σ ∈ A n q 1 , . . . , q n , q ∈ Q Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 37 / 24

  68. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata Bottom-Up, Non-Deterministic, Finite A = { ∧ , ∨ / 2 , ¬ / 1 , ⊤ , ⊥ / 0 } , Q = { q 0 , q 1 } , F = { q 1 } , ∆ = � ⊤ → q 1 , � � ⊥ → q 0 , ¬ ( q b ) → q ¬ b � b, b ′ ∈ { 0, 1 } � � ∧ ( q b , q b ′ ) → q b ∧ b ′ , ∨ ( q b , q b ′ ) → q b ∨ b ′ t = ∧ ¬ ∨ ∧ ⊥ ¬ ⊥ ⊤ ⊥ Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 38 / 24

  69. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata Bottom-Up, Non-Deterministic, Finite → ∗ → ∗ → ∗ ∧ ∧ ∧ ∆ ∆ ∆ ¬ ∨ ¬ ∨ ¬ ∨ ∧ ⊥ ¬ ∧ q 0 ¬ q 0 q 0 q 1 ⊥ ⊤ ⊥ q 0 q 1 q 0 → ∆ q 1 ∧ q 1 q 1 Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 38 / 24

  70. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata Runs and Languages The reduction t → ∗ ∆ q 1 is captured by the run : q 1 decorated: ε ∧ q 1 q 1 q 1 1 ¬ q 1 2 ∨ q 1 q 0 q 0 q 1 11 ∧ q 0 21 ⊥ q 0 22 ¬ q 1 q 0 q 1 q 0 111 ⊥ q 0 112 ⊤ q 1 221 ⊥ q 0 Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 39 / 24

  71. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] TAGE, TA = , Positive TAGED, A = � A , Q, F, ∆, ≅ � : � A , Q, F, ∆ � vanilla tree automaton ta ( A ) ≅ equality constraints , ≅ ⊆ Q 2 Constraint p ≅ q : run ρ of A on t : run of ta ( A ) on t satisfying ≅ : ∀ α, β ∈ P ( t ) ; ρ ( α ) ≅ ρ ( β ) ⇒ t | α = t | β accepting run : accepting for ta ( A ) Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 40 / 24

  72. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] q ≅ ^ A = { a/ 0 , f/ 2 } , Q = { q, ^ q, q f } , F = { q f } , ^ q , and ∆ = { f (^ q, ^ q ) → q f , f ( q, q ) → q, f ( q, q ) → ^ q, a → q, a → ^ q } u = f and v = f f f f a a a a a a a Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 41 / 24

  73. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] q ≅ ^ A = { a/ 0 , f/ 2 } , Q = { q, ^ q, q f } , F = { q f } , ^ q , and ∆ = { f (^ q, ^ q ) → q f , f ( q, q ) → q, f ( q, q ) → ^ q, a → q, a → ^ q } u, ρ u = f q f and v = f f ^ f ^ f a q q a q a q a q a q a a Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 41 / 24

  74. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] q ≅ ^ A = { a/ 0 , f/ 2 } , Q = { q, ^ q, q f } , F = { q f } , ^ q , and ∆ = { f (^ q, ^ q ) → q f , f ( q, q ) → q, f ( q, q ) → ^ q, a → q, a → ^ q } u = f and v, ρ v = f q f f f f ^ a ^ q q a a a a a q a q Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 41 / 24

  75. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] A = { ∧ , ∨ / 2 , ¬ / 1 , ⊤ , ⊥ / 0 } ⊎ X , Q = { q 0 , q 1 } ⊎ { v x | x ∈ X } and F = { q 1 } , new rules ⊤ → v x , ⊥ → v x , x ( q 0 , v x ) → q 1 , x ( v x , q 1 ) → q 0 for each x ∈ X , v x ≅ v x . ( x ∧ y ) ∨ ¬ x ≡ ∨ ∧ ¬ x y x ⊥ ⊤ ⊥ ⊤ ⊥ ⊤ Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 42 / 24

  76. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Tree Automata With Global Equality Constraints [Filiot et al., 2008] A = { ∧ , ∨ / 2 , ¬ / 1 , ⊤ , ⊥ / 0 } ⊎ X , Q = { q 0 , q 1 } ⊎ { v x | x ∈ X } and F = { q 1 } , new rules ⊤ → v x , ⊥ → v x , x ( q 0 , v x ) → q 1 , x ( v x , q 1 ) → q 0 for each x ∈ X , v x ≅ v x . ( x ∧ y ) ∨ ¬ x ≡ ∨ q 1 ∧ q 0 ¬ q 1 x q 0 y q 1 x q 0 ⊥ v x ⊤ q 1 ⊥ q 0 ⊤ v y ⊥ v x ⊤ q 1 Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 42 / 24

  77. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References TA versus RTA versus TA = Closure, Complexity and Decidability RTA ( p ≅ p ) TA = TA ∪ PTime PTime PTime ∩ PTime ExpTime ExpTime ∅ ∅ ¬ ExpTime NP -c (a) t ∈ L ( A ) ? NP -c PTime L ( A ) = ∅ ? linear-time linear-time ExpTime -c |L ( A ) | ∈ N ? ExpTime -c PTime PTime L ( A ) = T ( Σ ) ? ExpTime -c undecidable undecidable L ( A ) ⊆ L ( B ) ? ExpTime -c undecidable undecidable L ( � i A i ) = ∅ ? ExpTime -c ExpTime -c ExpTime -c (a) SAT solver approach: [Héam et al., 2010]. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 43 / 24

  78. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References TA versus RTA versus TA = Closure, Complexity and Decidability RTA ( p ≅ p ) TA = TA ∪ PTime PTime PTime ∩ PTime ExpTime ExpTime ∅ ∅ ¬ ExpTime NP -c (a) t ∈ L ( A ) ? NP -c PTime L ( A ) = ∅ ? linear-time linear-time ExpTime-c |L ( A ) | ∈ N ? PTime ExpTime-c PTime L ( A ) = T ( Σ ) ? ExpTime -c undecidable undecidable L ( A ) ⊆ L ( B ) ? ExpTime -c undecidable undecidable L ( � i A i ) = ∅ ? ExpTime -c ExpTime -c ExpTime -c (a) SAT solver approach: [Héam et al., 2010]. Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 43 / 24

  79. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References TA = versus TA = k Restriction on the kind of constraints: Rigid Automata (RTA) Same expressive power as TA = Less compact representations Linear emptiness / finiteness tests, vs. ExpTime -complete Applications: [Jacquemard et al., 2009, Vacher, 2010] What of the number of constraints? TA = k A = � Σ, Q, F, ∆, ≅ � : TA = A � Σ, Q, F, ∆, ≅ � ≅ such that Card ( ≅ ) � k Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 44 / 24

  80. Preliminaries LTL Checking Bounded TAGE Other Works Appendices References Expressive Power The Separation Languages L = ( ℓ k ) k ∈ N [Hugot, 2013] k � A i ⊎ { σ/ 3 , ⊥ / 0 } A i = { a i , b i / 0 , f i , g i / 2 } i = 1 ℓ 0 = { ⊥ } ∀ k � 1, ℓ k = { σ ( u, u, t k − 1 ) | u ∈ T ( A k ) , t k − 1 ∈ ℓ k − 1 } u i ∈ T ( A i ) ∀ i σ u k u k σ u k − 1 u k − 1 σ u 1 u 1 ⊥ , Tree (Not Quite) Regular Model-Checking Vincent HUGOT Ph.D. Defence 45 / 24

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend