Overview LTL to Buchi Buchi Model Checking LTL Translating LTL into Buchi Ralf Huuck Buchi Automata Example Automaton which accepts infinite traces δ A Buchi automaton is 5-tuple Σ, Q, Q 0,δ, F Σ is a finite alphabet Q is a finite set of states Q 0 Q is a subset of initial states δ: Q Σ P (Q) is a transition relation F Q is a subset of accepting states An infinite sequence of states is accepted iff it contains accepting states infinitely often b a a c S 0 S 1 S 2 b σ 1 =S 0 S 1 S 2 S 2 S 2 S 2 σ 2 =S 0 S 1 S 2 S 1 S 2 S 1 ACCEPTED ACCEPTED σ 3 =S 0 S 1 S 2 S 1 S 1 S 1 REJECTED 1
Model Checking LTL Model Checking LTL A sys φ Basic idea: A φ automaton describing system LTL specification automaton representing φ exactly A sys φ Basic idea: A φ automaton describing system LTL specification automaton representing φ exactly check check L(A sys ) L(A φ ) L(A sys ) L(A φ )= negation Key Problem Easy for Non-Temporal Σ p q S 0 {p, q,...} S 1 How translate LTL formula into Buchi automaton? Σ p q {q,...} S 0 { p,...} S 1 How to do it for temporal formulas? 2
Different Approaches e.g.: tableau construction Kersten, Manna, McGuire, Pnueli Gerth, Peled, Vardi, Wolper local/eventuality automaton Vardi, Wolper automata theoretic Vardi Construction via Local/Eventuality Automaton different ways to tackle, all are not simple and straightforward Idea LTL Syntax 1. reducing number of temporal LTL operators to U, and X for any LTL formula φ 2. construct local automaton for φ describes all possible behaviors that do not violate φ does not guarantee termination of U 3. construct eventuality automaton for φ accepts exactly terminating U 4. intersect both automata LTL formula are inductively defined by: φ ::= p φ φ 1 φ 2 Xφ Fφ Gφ φ 1 Uφ 2 p denotes atomic proposition X denotes next-state operator F denotes eventually/finally G denotes always/globally U denotes until 3
LTL semantics LTL formula φ interpreted over infinite paths of states π=s 0 s 1 s 2 we define LTL wrt Kripke structure M M,π²φ denotes φ holds in a path π of Kripke structure M. M²φ iff all paths of M satisfy φ, i.e., for all π in M we have M,π²φ Semantics of LTL Operators let π k denote suffix s k s k+1 s k+2... (k 0) M,π² p iff s 0 ² p, i.e., p μ(s 0 ) M,π² φ iff not M,π²φ M,π²φ 1 φ 2 iff M,π²φ 1 or M,π²φ 2 M,π² Xφ iff M,π 1 ²φ, i.e., s 1 s 2 s 3... satisfies φ M,π² Fφ iff k 0 s.t. M,π k ²φ M,π² Gφ iff k 0 M,π k ²φ M,π² φ 1 Uφ 2 iff k 0 s.t. M,π k ² φ 2 and 0 j<k we have M,π j ² φ 1 Reducing Number of Operators Preliminaries (1) Fφ can be expressed by true U φ Gφ can be expressed by F φ Exercise: PROOF closure cl(φ) of a LTL formula φ φ cl(φ) ψ 1 ψ 2 cl(φ), then ψ 1, ψ 2 cl(φ) ψ cl(φ), then ψ cl(φ) Xψ cl(φ), then ψ cl(φ) ψ 1 U ψ 2 cl(φ), then ψ 1, ψ 2 cl(φ) i.e., set of all sub-formulas and their negation 4
Example Closure Preliminaries (2) cl(ψ 1 U ψ 2 ) = { ψ 1 U ψ 2, (ψ 1 U ψ 2 ), ψ 1, ψ 1, ψ 2, ψ 2 } other examples? Sub(φ) is the set of all maximal subsets of cl(φ), that have no propositional inconsistency. ψ Sub(φ) iff ψ Sub(φ) ψ 1 ψ 2 Sub(φ), then ψ 1 Sub(φ) and ψ 2 Sub(φ) Example Sub Local Automaton cl(ψ 1 U ψ 2 ) = { ψ 1 U ψ 2, (ψ 1 U ψ 2 ), ψ 1, ψ 1, ψ 2, ψ 2 } Sub(ψ 1 U ψ 2 ) = { {ψ 1 U ψ 2, ψ 1, ψ 2 }, { }, { (ψ 1 U ψ 2 ), ψ 1, ψ 2 }, {ψ 1 U ψ 2, ψ 1, ψ 2 }, { (ψ 1 U ψ 2 ), ψ 1, ψ 2 } } A L φ =(2cl(φ), Sub(φ), δ L φ, Sub(φ), Sub(φ)) alphabet states transition relation initial states accepting states Sub φ (φ), all sets of Sub(φ), where φ holds 5
Example States Transition Relation δ L φ v δ L φ (u,a) iff a=u and u,v Sub(φ) Xψ u iff ψ v ψ 1 Uψ 2 u iff ψ 2 u or, ψ 1 u and ψ 1 Uψ 2 v Example Transitions (1) Example Transitions (2) { } { } { } { } { } 6
Example Transitions (3) Example Transitions (4) Example Transitions (5) Full Transition Relation 7
Almost... Eventuality Automaton (1) all init states are accepting, i.e., looping here ψ 1 U forever ψ 2, ψ 1, ψ 2 would be an accepting run task is to prevent looping of ψ 1 Uψ 2 without ever satisfying ψ 2 eventually ψ 2 has to hold Eventuality Automaton (2) Example Eventuality Automaton A E φ =(2cl(φ), 2 e(φ), δ E φ, { }, { }) ψ 1 U ψ 2 alphabet states transition relation initial states accepting states e(φ), subset of cl(φ) which exactly contains all untils initial state + accepting state 8
Transition Relation δ E φ Transition Relation δ E φ v δ E φ (u,a) iff u,v 2 e(φ) a 2 cl(φ) v δ E φ (u,a) iff u,v 2 e(φ) a 2 cl(φ) u= and for all ψ 1 Uψ 2 a, either ψ 2 a or ψ 1 Uψ 2 v u= and for all ψ 1 Uψ 2 a, either ψ 2 a or ψ 1 Uψ 2 v u and for all ψ 1 Uψ 2 u, either ψ 2 a or ψ 1 Uψ 2 v starting in initial/accepting state and we see ψ 1 Uψ 2, we also have to see either ψ 2 or ψ 1 Uψ 2 has to be in the target Example Eventuality Automaton Transition Relation δ E φ {ψ 1 Uψ 2, ψ 2,...} {ψ 1 Uψ 2,...} ψ 1 U ψ 2 {ψ 2,...} v δ E φ (u,a) iff u and for all ψ 1 Uψ 2 u, either ψ 2 a or ψ 1 Uψ 2 v in an ψ 1 Uψ 2 state, we see either ψ 2 or in the target ψ 1 Uψ 2 u,v 2 e(φ) a 2 cl(φ) initial state + accepting state 9
Example Eventuality Automaton Example Eventuality Automaton {ψ 2,...} ψ 1 U ψ 2 {ψ 1 Uψ 2,...} {ψ 2,...} ψ 1 U ψ 2 {ψ 1 Uψ 2,...} {ψ 2,...} {ψ 1 Uψ 2,...} initial state + accepting state initial state + accepting state Intersection of Both Automata Complexity does what it is supposed to do EXERCISE each node in local automaton is maximal, i.e., contains each subformula either negated or non-negated: number of nodes exponential in size of formula. eventuality automaton has states consisting of sets of until formulas: exponential in number of until formulas then product, then reduction to reachable states heaps of overhead here, other methods are smarter... 10
Lessons learnt Model checking by checking inclusion requires LTL to Buchi transformation can be constructed through locality/eventuality automaton THE END 11