Tools and Algorithms for the Construction and Analysis of Systems, 4 conf., TACAS '98

Lecture Notes in Computer Science Edited by G. Goos, J. Hartmanis and J. van Leeuwen

1384

Bernhard Steffen (Ed.)

Tools and Algorithms for the Construction and Analysis of Systems 4th International Conference, TACAS'98 Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS'98 Lisbon, Portugal, March 28 - April 4, 1998 Proceedings

Springer

Series Editors Gerhard Goos, Karlsruhe University, Germany Juris Hartmanis, Cornell University, NY, USA Jan van Leeuwen, Utrecht University, The Netherlands

Volume Editor Bernhard Steffen Universitat Dortmund, Lehrstuhl fiar Programmiersysteme Fachbereich Informatik D-44221 Dortmund, Germany E-mail: steffen @informatik.uni-dortmund.de Cataloging-in-Publication data applied for

Die Deutsche Bibliothek - CIP-Einheitsaufnahme

Tools and algorithms for the construction and analysis of systems : 4th international conference ; proceedings / TACAS '98, held as part of the Joint European Conferences on Theory and Practice of Software, ETAPS '98, Lisbon, Portugal, March 28 - April 4, 1998. Bernhard Steffen (ed.). - Berlin ; Heidelberg ; New York ; Barcelona ; Budapest ; Hong Kong ; London ; Milan ; Paris ; Santa Clara ; Singapore ; Tokyo : Springer, 1998 (Lecture notes in computer science ; Vol. 1384) ISBN 3-540-64356-7

CR Subject Classification (1991): E3, D.2.4, D.2.2, C.2.4 ISSN 0302-9743 ISBN 3-540-64356-7 Springer-Verlag Berlin Heidelberg New York This work is subject to copyright. All rights are reserved, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, re-use of illustrations, recitation, broadcasting, reproduction on microfilms or in any other way, and storage in data banks. Duplication of this publication or parts thereof is permitted only under the provisions of the German Copyright Law of September 9, 1965, in its current version, and permission for use must always be obtained from Springer -Verlag. Violations are liable for prosecution under the German Copyright Law. 9 Springer-Verlag Berlin Heidelberg 1998 Printed in Germany Typesetting: Camera-ready by author SPIN 10632045 06/3142 - 5 4 3 2 1 0

Printed on acid-free paper

Foreword The European conference situation in the general area of software science has long been considered unsatisfactory. A fairly large number of small and medium-sized conferences and workshops take place on an irregular basis, competing for high-quality contributions and for enough attendees to make them financially viable. Discussions aiming at a consolidation have been underway since at least 1992, with concrete planning beginning in summer 1994 and culminating in a public meeting at TAPSOFT'95 in Aarhus. On the basis of a broad consensus, it was decided to establish a single annual federated spring conference in the slot that was then occupied by TAPSOFT and CAAP/ESOP/CC, comprising a number of existing and new conferences and covering a spectrum from theory to practice. ETAPS'98, the first instance of the European Joint Conferences on Theory and Practice of Software, is taking place this year in Lisbon. It comprises five conferences (FoSSaCS, FASE, ESOP, CC, TACAS), four workshops (ACoS, VISUAL, WADT, CMCS), seven invited lectures, and nine tutorials. The events that comprise ETAPS address various aspects of the system development process, including specification, design, implementation, analysis and improvement. The languages, methodologies and tools which support these activities are all well within its scope. Different blends of theory and practice are represented, with an inclination towards theory with a practical motivation on one hand and soundly-based practice on the other. Many of the issues involved in software design apply to systems in general, including hardware systems, and the emphasis on software is not intended to be exclusive. ETAPS is a natural development from its predecessors. It is a loose confederation in which each event retains its own identity, with a separate programme committee and independent proceedings. Its format is openended, allowing it to grow and evolve as time goes by. Contributed talks and system demonstrations are in synchronized parallel sessions, with invited lectures in plenary sessions. Two of the invited lectures are reserved for "unifying" talks on topics of interest to the whole range of ETAPS attendees. The aim of cramming all this activity into a single one-week meeting is to create a strong magnet for academic and industrial researchers working on topics within its scope, giving them the opportunity to learn about research in related areas, and thereby to foster new and existing links between work in areas that have hitherto been addressed in separate meetings.

vI ETAPS'98 has been superbly organized by Jos~ Luis Fiadeiro and his team at the Department of Informatics of the University of Lisbon. The ETAPS steering committee has put considerable energy into planning for ETAPS'98 and its successors. Its current membership is: Andr~ Arnold (Bordeaux), Egidio Astesiano (Genova), Jan Bergstra (Amsterdam), Ed Brinksma (Enschede), Rance Cleaveland (Raleigh), Pierpaolo Degano (Pisa), Hartmut Ehrig (Berlin), Jos~ Fiadeiro (Lisbon), Jean-Pierre Finance (Nancy), Marie-Claude Gaudel (Paris), Tibor Gyimothy (Szeged), Chris Hankin (London), Stefan Jahnichen (Berlin), Uwe Kastens (Paderborn), Paul Klint (Amsterdam), Kai Koskimies (Tampere), Tom Maibaum (London), Hanne Riis Nielson (Aarhus), Fernando Orejas (Barcelona), Don Sannella (Edinburgh, chair), Bernhard Steffen (Dortmund), Doaitse Swierstra (Utrecht), Wolfgang Thomas (Kiel) Other people were influential in the early stages of planning, including Peter Mosses (Aarhus) and Reinhard Wilhelm (Saarbrficken). ETAPS'98 has received generous sponsorship from: Portugal Telecom TAP Air Portugal the Luso-American Development Foundation the British Council the EU programme "Training and Mobility of Researchers" the University of Lisbon the European Association for Theoretical Computer Science the European Association for Programming Languages and Systems the Gulbenkian Foundation I would like to express my sincere gratitude to all of these people and organizations, and to Jos~ in particular, as well as to Springer-Verlag for agreeing to publish the ETAPS proceedings. Edinburgh, January 1998

Donald Sannella ETAPS Steering Committee chairman

Preface This volume contains the proceedings of the 4th TACAS, International Conference on Tools and Algorithms for the Construction and Analysis of Systems. TACAS'98 took place at the Gulbenkian Foundation in Lisbon, Portugal, March 31st to April 3rd, 1998, as part of the First European Joint Conferences on Theory and Practice of Software (ETAPS), whose aims, organization, and history are detailed in the separate foreword by Donald Sannella. It is the goal of TACAS to bring together researchers and practitioners interested in the development and application of tools and algorithms for specification, verification, analysis, and construction of software and hardware systems. In particular, it aims at creating an atmosphere that promotes a cross-fertilization of ideas between the different communities of theoreticians, tool builders, tool users, and system designers, in various specialized areas of computer science. In this respect, TACAS reflects the overall goal of ETAPS under a tool-oriented perspective. In fact, the scope of TACAS intersects with all the other ETAPS events, which address more traditional areas of interest. As a consequence, in addition to the standard criteria for acceptability, contributions have also been selected on the basis of their conceptual significance in the context of neighbouring areas. This comprises the profile-driven comparison of various concepts and methods, their degree of support via interactive or fully automatic tools, and in particular case studies revealing the application profiles of the considered methods and tools. In order to emphasize the practical importance of tools, TACAS allows tool presentations to be submitted (and reviewed) on equal footing with traditional scientific papers, treating them as 'first class citizens'. In practice, this entails their presentation in plenary conference sessions, and the integral inclusion of a tool report in the proceedings. The conference, of course, also included informal tool demonstrations, not announced in the official program. TACAS'98 comprised - A n i n v i t e d L e c t u r e by Randal Bryant, the 'father' of the Binary Decisions Diagrams (BDDs), which have become over the last decade the most prominent data structures for industrially relevant tools, as well as

VIII

-

R e g u l a r Sessions featuring 28 papers selected from 78 submissions, ranging from foundational contributions to tool presentations including online demos.

Grown itself out of a satellite meeting to TAPSOFT in 1995, TACAS'98 featured two new satellite events: - ACOS'98, International Workshop on Advanced Communication Services, on April 3 - 4, and~ - VISUAL'98, International Workshop on Visualization Issues f o r Formal Methods, on April 4th

selected papers of which appear in Volume 1385 of Springer Verlag's Lecture Notes in Computer Science. TACAS'98 was hosted by the University of Lisbon, and, being part of ETAPS, it shared the excellent sponsoring and support described in Donald Sannella's foreword. Like ETAPS, TACAS will be continued next year at the University of Amsterdam, and in 2000 at the Technical University of Berlin. Finally, warm thanks are due to the program committee and to all the referees for their assistance in selecting the papers, to Donald Sannella for mastering the coordination of the whole ETAPS, to Jos~ Luiz Fiadeiro and his local team for their brilliant organization, and, last but not least, to Claudia Herbers for her professional assistance during the last months and for her first class support in the preparation of this volume.

Dortmund, March 1998

Bernhard Steffen

IX

Program C o m m i t t e e Ed Brinksma (NL) Rance Cleaveland (USA) Fausto Giunchiglia (I) Susanne Graf (F) Tom Henzinger (USA) Daniel Jackson (USA) Kurt Jensen (DK)

Kim G. Larsen (DK) Tiziana Margaria (D) Jens Palsberg (DK) Doron Peled (USA) Scott Smolka (USA) Bernhard Steffen (D, chair) Frits Vaandrager (NL)

Referees Rajeev Alur Henrik Reif Andersen Alessandro Armando Alessandro Artale Michael von der Beeck M. Benerecetti Karen Bernstein Piergiorgio Bertoli Ahmed Bouajjani Marius Bozga Francesco Calzolari Scren Christensen Alessandro Cimatti Andreas Clat~en Pedro D'Argenio Luca de Alfaro Marco Daniele Rob DeLine Srinivas Devadas Yifei Dong Xiaoqun Du Ansgar Fehnker Stephen Garland Klaus Havelund Gerard Holzmann

Thierry J~ron Somesh Jha Joost Pieter Katoen Peter Kelb Nils Klarlund Josva Kleist Lars M. Kristensen Ks Kristoffersen Orna Kupferman Rom Langerak Markus Mtiller-Olm Angelika Mader Ken McMillan Michael Mendler Kjeld Mortensen Laurent Mounier Gall Murphy George Necula Uwe Nestmann Mogens Nielsen Albert Nymeyer Robert O'Callahan Florence Pagani Wojciech Penczek Anuj Puri

Shaz Qadeer C.R. Ramakrishnan Pascal Raymond Marco Roveri Vlad Rusu Theo Ruys Elmer Sandvad Roberto Sebastiani Luciano Serafini Arne Skou Oleg Sokolsky Jan Springintveld Andrzej Szalas Jan Tretmans Stavros Tripalds Antti Valmari Moshe Vardi Kimmo Varpaaniemi Mandana Vazhiri Adolfo Villafiorita Carsten Weise Hanno Wupper Husnu Yenigtin Job Zwiers

Contents Invited Lecture Formal Verification of Pipelined Processors . . . . . . . . . . . . . . . . . . . . . . . . . R.E. Bryant

Regular Sessions 1. Model Checking

Fully Local and Efficient Evaluation of Alternating Fixed Points ... Xinxin Liu, C.R. Ramakrishnan, S.A. Smolka

5

Modular Model Checking of Software . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K. Laster, O. Grumberg

20

Verification Based on Local States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M. Huhn, P. Niebert, F. WaNner

36

Exploiting Symmetry in Linear Time Temporal Logic Model Checking: One Step Beyond . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . K. Ajami, S. Haddad, J.-M. Ilid

52

2. Design and Architecture OPEN/C/ESAR: An Open Software Architecture for Verification, Simulation, and Testing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . H. Garavel Practical Model Checking Using Games . . . . . . . . . . . . . . . . . . . . . . . . . . . . P. Stevens, C. Stirling Combining Finite Automata, Parallel Programs and SDL Using Petri Nets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B. Grahlmann MESA: Support for Scenario-Based Design of Concurrent Systems H. Ben-Abdallah, S. Leue

68 85

102 118

3. Various Applications Efficient Modeling of Memory Arrays in Symbolic Ternary Simulation M. N. Velev, R. E. Bryant

136

Translation Validation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . A. Pnueli, M. Siegel, E. Singerman

151

Xll A Verified Model Checker for the Modal #-Calculus in Coq . . . . . . . .

167

C. Sprenger Detecting Races in Relay Ladder Logic Programs . . . . . . . . . . . . . . . . . .

184

A. Aiken, M. F~hndrich, Z. Su 4. Fielded Applications Verification of Large State/Event Systems Using Compositionality and Dependency Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . J. Lind-Nielsen, H. Reif Andersen, G. Behrmann, H. Hulgaard,

201

K. Kristoffersen, K.G. Larsen Tamagotchis Need Not Die - Verification of STATEMATEDesigns ...

217

U. Brockmeyer, G. Wittich Modeling and Verification of s C + + Applications . . . . . . . . . . . . . . . . . . . T. Cartel Factotum: Automatic and Systematic Sharing Support for Systems Analyzers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D.J. Sherman, N. Maga/er

232

249

5. Verification of Real-Time Systems Model Checking via Reachability Testing for Timed Automata . . . . . L. Aceto, A. Burguefio, K.G. Larsen

263

Formal Design and Analysis of a Gear Controller . . . . . . . . . . . . . . . . . . .

281

M. Lindahl, P. Pettersson, W. Yi Verifying Networks of Timed Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

298

P. Aziz Abdulla, B. Jonsson Model Checking of Real-Time Reachability Properties Using Abstractions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

313

C. Daws, S. Tripakis 6. Mixed Analysis Techniques Symbolic Exploration of Transition Hierarchies . . . . . . . . . . . . . . . . . . . . .

330

R. Alur, T.A. Henzinger, S.K. Rajamani Static Partial Order Reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

345

R. Kurshan, V. Levin, M. Minea, D. Peled, H. Yenigiin Set-Based Analysis of Reactive Infinite-State Systems . . . . . . . . . . . . . .

358

W. Charatonik, A. Podelski Deciding Fixed and Non-fixed Size Bit-Vectors . . . . . . . . . . . . . . . . . . . . .

N.S. Bjcrner, M.C. Pichora

376

Xlll

7. Case Studies and Experience Experience with Literate P r o g r a m m i n g in the Modelling and Validation of Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T.C. Ruys, E. Brinksma A Proof of Burns N-Process Mutual Exclusion Algorithm Using Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

393

409

H.E. Jensen, N.A. Lynch A u t o m a t e d Verification of Szymanski's Algorithm . . . . . . . . . . . . . . . . . . E.P. Gribomont, G. Zenner Formal Verification of SDL Systems at the Siemens Mobile Phone Department .......................................................

424

439

F. Regensburger, A. Barnard Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

457

Formal Verification of Pipelined Processors? Randal E. Bryant Carnegie Mellon University, Pittsburgh PA 15213, USA Abstract. Correspondence checking formally verifies that a pipelined microprocessor realizes the serial semantics of the instruction set model. By representing the circuit state symbolically with Ordered Binary Decision Diagrams (OBDDs), this correspondence checking can be performed directly on a logic-level representation of the circuit. Our ongoing research seeks to make his approach practical for real-life microprocessors.

1

Motivation

Microprocessors are among the most complex electronic systems created today. High performance processors require millions of transistors and employ complex techniques such as pipelining, multiple instruction issue, branch prediction, speculative and/or out-of-order execution, register renaming, and many forms of caching. When correctly implemented, these implementation artifacts should be invisible to the user. The processor should produce the same results as if it had executed the machine code in strict, sequential order. Design errors can often lead to violations of the sequential semantics. For example, an update to a register or memory location by one instruction may not be detected by an instruction following too closely in the pipeline. An instruction following a conditional branch may be executed prematurely, modifying a register even though the processor later determines that the branch is taken. Such hazard possibilities increase dramatically as the instruction pipelines increase in both depth and width. Historically, microprocessor designs have been validated by extensive simulation. Instruction sequences are executed, in simulation, on two different models: a high-level model describing the desired effect of each instruction and a lowlevel model capturing the detailed pipeline structure. The results from these simulations are then compared for discrepancies. The instruction sequences may be taken from actual programs or synthetically generated to exercise different aspects of the pipeline structure [5]. Validation by simulation becomes increasingly costly and unreliable as processors increase in complexity. The number of tests required to cover all possible pipeline interactions becomes overwhelming. Furthermore, simulation test generators suffer from a fundamental limitation due to their use of information about the pipeline structure in determining the possible interactions in an instruction sequence that need to be simulated. A single conceptual design error can ?

This research was supported in part by the Defense Advanced Research Project Agency, Contract DABT63-96-C-0071, and in part by the Semiconductor Research Corporation, Contract 97-DC-068.

B. Steffen (Ed.): TACAS 98 c Springer–Verlag Berlin Heidelberg 1998 LNCS 1384, pp. 1–4, 1998.

2

yield both an improperly-designed pipeline and a failure to test for a particular instruction combination. As an alternative to simulation, a number of researchers have investigated using formal verification techniques to prove that a pipelined processor preserves the semantics of the instruction set model. Formal verification has the advantage that it demonstrates correct execution for all possible instruction sequences. Our interest is in developing automated techniques that apply powerful symbolic evaluation techniques to analyze the behavior of the processor over all possible operating conditions. We believe that high degrees of automation are essential to gaining acceptance by chip designers.

2

Verification Methodology

Our task is to verify that a processor will execute all possible instruction sequences properly. Since there is an infinite number of possible sequences, this condition cannot be proved directly. Instead, we show that each possible individual instruction will be executed correctly, regardless of the preceding and following instruction sequences. The correct execution of a complete sequence then follows by induction on its length. One methodology for proving the correctness of individual instructions is based on proving the invariance of an abstraction function between processor and program states by each instruction execution. A similar methodology was proposed by Hoare for proving the correctness of each operation in the implementation of an abstract data type [4]. We model the processor as having states in the set Qpipe, and the behavior of the processor for each clock cycle of operation by a next-state function δpipe : Qpipe → Qpipe. Similarly, the state visible to the assembly language programmer (typically the main memory, integer and floating point registers, program counter, and other status registers) is modeled by a state set Qprog and the execution of a single instruction by a next-state function δprog : Qprog → Qprog . In our simplified formulation, we we do not consider the input or output to the processor, but rather that the action taken on each step is determined by the program or pipeline state. Our task is to show a correspondence between the transformations on the pipeline state by the processor and on the program state by the instruction execution model. This correspondence can be described by an abstraction function Abs: Qpipe → Qprog identifying which program state is represented by a given pipeline state. Typically, this corresponds to the effect of completing any instructions in the pipeline without fetching any new instructions. For each pipeline state, there must be a value k indicating the number of clock cycles required after fetching the most recent instruction until the next instruction can be fetched. Our correctness condition states that the effect of fetching and executing a single instruction should match the effect of performing the corresponding instruction on the program state. That is, for all Qpipe ∈ Qpipe, there must be a k such that k (Qpipe)) δprog (Abs(Qpipe)) = Abs(δpipe

(1)

In addition to the invariance property described in Equation 1, we require Abs to be surjective to guarantee that all program behaviors can be realized.

3

That is, for every program state Qprog , there must be a state Qpipe such that Abs(Qpipe) = Qprog . Beyond this requirement, the abstraction function can be arbitrary, as long as it satisfies Equation 1. The validity of the verification is not compromised by an incorrect abstraction function. That is, an invalid abstraction function will not cause the verifier yield a “false positive” result, declaring a faulty pipeline to be correct. We can let user provide us with the abstraction function [1,6], but this becomes very cumbersome with increased pipeline complexity. Alternatively, we can attempt to derive the abstraction function directly from the pipeline structure [3]. Unlike simulation test generation, using information about the pipeline structure does not diminish the integrity of the verification.

3

Automated Correspondence Checking

Burch and Dill [3] first proposed using the pipeline description to automatically derive its abstraction function. They do this by exploiting two properties found in many pipeline designs. First, the programmer-visible state is usually embedded within the overall processor state. That is, there are specific register and memory arrays for the program registers, the main memory, and the program counter. Second, the hardware has some mechanism for “flushing” the pipeline, i.e., to complete all instructions in the pipeline without fetching any new ones. For example, this would occur when the instruction cache misses and hence no new instructions could be fetched. A symbolic simulator, which can model the behavior of the circuit over symbolically-represented states, can automatically derive the abstraction function. First, we initialize the circuit to an arbitrary, symbolic state, covering all the states in Qpipe. We then symbolically simulate behavior of a processor flush. We then examine the state in the program visible register and memory elements and declare these symbolic values to represent the mapping Abs. Using similar symbolic simulation techniques, we can also compute the effect of the processor on an arbitrary pipeline state δpipe and the effect of executing an arbitrary program instruction δprog . Thus, a symbolic simulator can solve the key problems related to verifying pipeline processors. Burch and Dill use symbolic simulation tools based on a logic of uninterpreted functions with equality, a weakened form of first order predicate calculus. Using this weak form, they can guarantee a complete decision procedure. Using their approach requires having a model of the circuit that abstracts away many details, including the sizes of the memory and register arrays, the bit widths of the data paths, and even the functionality of the data operations. This abstract model allows them to concentrate on the key issues of pipeline structure and control. Unfortunately, it can be difficult and time-consuming to derive such a model from the circuit description and to maintain it as the circuit design evolves. In addition, determining the correctness of some aspects of the circuit behavior require more detailed information about the data operations.

4

Verifying at the Bit-Level

Our recent research has focussed on adapting Burch and Dill’s verification methodology to operate directly on a low-level model of the circuit, in which state is

4

explicitly represented by sets of Boolean values and the state transformations are described by Boolean functions over this state. Such a model can be derived directly from a logic-level description of the circuit, avoiding the need to manually create a more abstract model. Instead of manipulating symbolic variables representing abstract state and uninterpreted functions, we use Ordered Binary Decision Diagrams (OBDDs) [2] to represent the symbolic circuit state. OBDDs have the advantage over other approaches to symbolic Boolean manipulation of being canonical as well as reasonably compact for many of the functions encountered in modeling digital circuits. Many difficult hurdles must be overcome to make bit-level correspondence checking practical. One problem is to find an efficient representation of the initial, but arbitrary pipeline state, given the large number of memory elements found in a processor. A naive approach would be to introduce a distinct Boolean variable for each bit in each register or memory array, but this could require thousands, or even millions of variables. Instead, we have developed techniques to introduce only as many variables as are needed to represent the states of the symbolic locations that are actually accessed during the execution of the instruction sequence [7]. Since the sequences we symbolically simulate are relatively short, this leads to a greatly reduced number of variables. Other problems are related to the OBDD complexities caused when modeling the interactions between successive instructions, such as when the value generated by one instruction becomes the target address by a later jump instruction. We have made some progress in this area, but much more is required before we will be able to handle full scale microprocessors.

References 1. S. Bose, and A. L. Fisher, “Verifying Pipelined Hardware Using Symbolic Logic Simulation,” International Conference on Computer Design (ICCD ’89), 1989, pp. 217–221. 2. R. E. Bryant, “Symbolic Boolean Manipulation with Ordered Binary Decision Diagrams,” ACM Computing Surveys, Vol. 24, No. 3 (September, 1992), pp. 293– 318. 3. J. R. Burch, and D. L. Dill, “Automated Verification of Pipelined Microprocessor Control,” Computer-Aided Verification (CAV ’94), LNCS 818, Springer-Verlag, June, 1994, pp. 68–80. 4. C. A. R. Hoare, “Proof of Correctness of Data Representations,” Acta Informatica Vol. 1, 1972, pp. 271–281. 5. M. Kantrowitz, and L. M. Noack, “I’m Done Simulating; Now What? Verification Coverage Analysis and Correctness Checking of the DECchip 21164 Alpha Microprocessor,” 33rd Design Automation Conference (DAC ’96), 1996, pp. 325–330. 6. K. L. Nelson, A. Jain, and R. E. Bryant, “Formal Verification of a Superscalar Execution Unit,” 34th Design Automation Conference (DAC ’97), June, 1997. 7. M. N. Velev, and R. E. Bryant, “Verification of Pipelined Microprocessors by Comparing Memory Execution Sequences in Symbolic Simulation,” Asian Computer Science Conference (ASIAN ’97), LNCS 1345, Springer-Verlag, December 1997, pp. 18–31.

Fully Local and Efficient Evaluation of Alternating Fixed Points? (Extended Abstract) Xinxin Liu, C. R. Ramakrishnan, and Scott A. Smolka Department of Computer Science State University of New York at Stony Brook Stony Brook, NY 11794 USA {xinxin,cram,sas}@cs.sunysb.edu +1 516 632-8334 (fax)

Abstract. We introduce Partitioned Dependency Graphs (PDGs), an abstract framework for the specification and evaluation of arbitrarily nested alternating fixed points. The generality of PDGs subsumes that of similarly proposed models of nested fixed-point computation such as Boolean graphs, Boolean equation systems, and the propositional modal mu-calculus. Our main result is an efficient local algorithm for evaluating PDG fixed points. Our algorithm, which we call LAFP, combines the simplicity of previously proposed induction-based algorithms (such as Winskel’s tableau method for ν-calculus model checking) with the efficiency of semantics-based algorithms (such as the bit-vector method of Cleaveland, Klein, and Steffen for the equational µ-calculus). In particular, LAFP is simply specified, we provide a completely rigorous proof of its correctness, and the number of fixed-point iterations required by the algorithm is asymptotically the same as that of the best existing global algorithms. Moreover, preliminary experimental results demonstrate that LAFP performs extremely well in practice. To our knowledge, this makes LAFP the first efficient local algorithm for computing fixed points of arbitrary alternation depth to appear in the literature.

1

Introduction

Model checking [CE81,QS82,CES86] is a verification technique aimed at determining whether a system specification possesses a property expressed as a temporal logic formula. Model checking has enjoyed wide success in verifying, or finding design errors in, real-life systems. An interesting account of a number of these success stories can be found in [CW96]. ?

Research supported in part by NSF grants CCR-9505562 and CCR-9705998, and AFOSR grants F49620-95-1-0508 and F49620-96-1-0087.

B. Steffen (Ed.): TACAS 98 c Springer–Verlag Berlin Heidelberg 1998 LNCS 1384, pp. 5–19, 1998.

6

Model checking has spurred interest in evaluating alternating fixed points as these are needed to express system properties of practical import, such as those involving subtle fairness constraints. Probably, the most canonical temporal logic for expressing alternating fixed points is the modal mu-calculus [Pra81,Koz83], which makes explicit use of the dual fixed-point operators µ (least fixed point) and ν (greatest fixed point). Intuitively, the alternation depth of a modal mucalculus formula [EL86] is the level of nontrivial nesting of fixed points in φ with adjacent fixed points being of different type. The term “alternating fixed point,” then, refers to such adjacent fixed points. In this paper, we present a very general framework for specifying and evaluating alternating fixed points. In particular, we introduce Partitioned Dependency Graphs (PDGs), whose generality subsumes that of similarly proposed models of nested fixed-point computation, such as Boolean graphs [And94], Boolean equation systems [VL94], the modal mu-calculus, and the equational µ-calculus [CKS92,BC96b]. A PDG is a directed hypergraph G with hyper-edges from vertices to sets of vertices. A PDG vertex x can be viewed as a kind of disjunctive normal form (DNF), with each of x’s target sets of vertices representing a disjunct (conjunctive term) of x. Moreover, the vertices of G are partitioned into blocks, each of which is labeled by µ or ν, and the ith block represents the ith-most nested fixed point. A subset A of G’s vertices is a proper evaluation of G if it respects the semantics of DNF (i.e., x is in A if one of its target sets is contained in A), and the semantics of the block labeling (i.e., the projection of A onto block i is the least fixed point of an appropriately defined function of A if this block is labeled by µ, and dually for ν). Our main result is a new local algorithm for evaluating PDG fixed points. Our algorithm, which we call LAFP, combines the simplicity of previously proposed induction-based algorithms (such as Winskel’s tableau method for ν-calculus model checking [Win89]), with the efficiency of semantics-based algorithms (such as the bit-vector method of Cleaveland, Klein, and Steffen for equational µcalculus model checking [CKS92]). LAFP takes as input a PDG G and a vertex x0 of G and determines, in a need-driven fashion, whether or not x0 is in the solution of G. LAFP thereby avoids the a priori construction of G. In contrast, global algorithms by definition require the a priori construction of a system’s state space, which results in good worst-case performance but poor performance in many practical situations. The main features of LAFP are the following: – Like the algorithm of [VL94], LAFP constructs a stable and complete search space—in the sense that PDG vertices belonging to the search space depend only upon vertices inside the search space—and does so in a need-driven manner. Moreover, it partitions the search space into three blocks I, O, and Q: those vertices currently considered to be inside the solution, those vertices currently considered to be outside the solution, and those whose status is currently unknown, respectively. – Like most fixed-point algorithms, LAFP computes PDG fixed points iteratively. By carefully accounting for the effects of moving a vertex x from Q to I or Q to O on vertices transitively dependent on x, LAFP avoids unneces-

7

sary recomputation when a fixed point is nested directly within the scope of another fixed point of the same type. As a result, the number of iterations required by LAFP to evaluate fixed points in a PDG with vertices V and al|+ad ad ) ). Asymptotically, this matches ternation depth ad is O((|V |−1)+( |V ad the iteration complexity of the best existing global algorithms. Moreover, a prototype implementation of LAFP based on the XMC model checker for the alternation-free modal mu-calculus [RRR+ 97] and the smodels stable models generator [NS96] demonstrates that LAFP performs extremely well in practice. – Because of the simplicity/abstractness of the PDG framework, the pseudocode for LAFP is clear and concise, and we provide a completely rigorous proof of the algorithm’s correctness. In terms of related work, LAFP is to our knowledge the first efficient local algorithm for evaluating structures of arbitrary alternation depth to appear in the literature. Tableau-based local algorithms such as [Win89,Cle90,SW91] suffer an exponential blowup even when the alternation-depth is fixed. The “semilocal” algorithm of [RS97] is demonstratably less “local” than LAFP, exploring more vertices than LAFP on certain examples. Several efficient local methods for various subsets of the µ-calculus have been proposed, including [And94,VL94,BC96a]. The algorithm of [VL94], which deals with Boolean Equation Systems of alternation depth 2, is closest to LAFP when their “restore strategy” no. 4 is used. However, we have found a counterexample to the algorithm’s correctness, the details of which can be found in Appendix A. It should also be noted that their algorithm, and their proposed generalization of their algorithm to higher alternation depths, is for a given alternation depth k fixed in advance. We see no obvious way to extend their algorithm to handle equational systems of arbitrary alternation depth. A number of global algorithms have been devised for the full µ-calculus, the most efficient of which are [CKS92,LBC+ 94]. The algorithm of [LBC+ 94] is more efficient time-wise (O(nad /2 ) vs. O(nad ) fixed-point iterations) but requires more space (O(nad /2 ) vs. O(n)). The LAFP algorithm is inspired by a model checking algorithm that appeared in [Liu92]. The structure of the rest of the paper is as follows. Section 2 defines our partitioned dependency graph framework. Section 3 presents LAFP, our local algorithm for PDG evaluation, along with an analysis of its correctness and computational complexity. The XMC-based implementation of LAFP and accompanying experimental results are the topic of Section 4. Finally, Section 5 concludes and identifies directions for future work. Because of space limitations, only proof outlines are given in this extended abstract. Full proofs can be found in http://www.cs.sunysb.edu/∼sas/lafp.ps.

2

Partitioned Dependency Graphs

A partitioned dependency graph (PDG) is a tuple (V, E, V1 . . . Vn , σ), where V is a set of vertices, E ⊆ V × ℘(V ) is a set of hyper-edges, V1 . . . Vn is a finite

8

sequence of subsets of V such that {V1 , . . . , Vn } is a partition of V , and σ : {V1 , . . . , Vn } → {µ, ν} is a function that assigns µ or ν to each block of the partition. Let θ ∈ {µ, ν}. We shall subsequently write σ(x) = θ if x ∈ Vi and σ(Vi ) = θ. Intuitively, a PDG G represents an equational system (in disjunctive normal form) having n nested, possibly alternating, blocks of boolean equations. V1 is the outermost block and Vn is the innermost block. For the reader familiar with nested boolean equation systems [VL94], a PDG (V, E, V1 . . . Vn , σ) can be viewed as a (arbitrarily) nested boolean equation W systemVwith equation blocks Vi and each x ∈ Vi having the equation x = (x,S)∈E y∈S y. Each Vi has the type σ(Vi ), and they are nested in the order given by V1 , . . . , Vn . Example 1. Let G = (V, E, V1 V2 , σ) be a PDG where V = {x, y, z}, V1 = {x, y}, V2 = {z}, E = {(x, {y}), (x, {z}), (y, {x}), (y, {z}), (z, {x, y})}, σ(V1 ) = ν, σ(V2 ) = µ. The corresponding nested boolean equation system is the following:  x=y∨z ν: y =x∨z µ: z =x∧y Let G = (V, E, V1 . . . Vn , σ) be a PDG. To give a formal semantics to PDGs, first notice that G induces two functions g, g¯ : ℘(V ) → ℘(V ) such that for A⊆V, g(A) = {x ∈ V | ∃(x, S) ∈ E. S ⊆ A}, g¯(A) = {x ∈ V | ∀(x, S) ∈ E. S ∩ A 6= ∅}. For A ⊆ V we write A for V − A. Clearly from the definition, for A ⊆ V it holds that g(A) = g¯(A). It is also clear from the definition that both g and g¯ are monotonic functions with respect to set inclusion. In words, a vertex x is in g(A) if x has a target set of vertices contained in A. Dually, x is in g¯(A) if each of x’s target sets has an element in A. Thus, g (¯ g ) allows us to interpret PDG vertices as boolean equations of disjunctive (conjunctive) normal forms. We write VG for ℘(V1 ) × · · · × ℘(Vn ). Define S φ: VG → ℘(V ) to be the flattening function such that for v ∈ VG , φ(v) = ni=1 v(i). Clearly φ is in one-one correspondence with its inverse φ− given by φ− (A) = (A ∩ V1 , . . . , A ∩ Vn ) for A ⊆ ℘(V ). For v ∈ VG , we will write v[x/k] for the updated version of v in which its ¯ for the componentwise complementation kth component is replaced by x, and v of v. We will also write ⊥ for (∅, . . . , ∅). With g, g¯ defined as above, a PDG further induces the 2n + 2 functions ¯0 , . . . , g ¯ n : VG → VG g0 , . . . , gn , g such that gn = φ− ◦ g ◦ φ,

¯n = φ− ◦ g¯ ◦ φ, and for v ∈ VG , k ∈ {1, . . . , n}, g  νu.gk (v[u(k)/k]) σ(Vk ) = ν , gk−1 (v) = µu.gk (v[u(k)/k]) σ(Vk ) = µ

9

 ¯k−1 (v) = g

νu.¯ gk (v[u(k)/k]) µu.¯ gk (v[u(k)/k])

σ(Vk ) = µ , σ(Vk ) = ν

where νu.gk (v[u(k)/k]) (µu.gk (v[u(k)/k])) is the maximum (minimum) u ∈ VG such that u = gk (v[u(k)/k]). Following the standard argument, λu.gk (v[u(k)/k]) is a monotonic function on the complete lattice (℘(V1 ) × . . . × ℘(Vn ), v), with v being the pointwise inclusion relation. Thus, by the Knaster¯k Tarski fixed-point theorem, such u do uniquely exist. The well definedness of g is guaranteed in the same way. Intuitively, the expression gk−1 (v) computes the fixed point of the kth block in environment v. Moreover, g0 (v) gives the solution to the entire equational system. Since G is a closed system, the choice of argument to g0 is irrelevant. Given a distinguished vertex x0 in V , the problem then of locally evaluating G is the one of determining whether x0 ∈ φ(g0 (⊥)).

3

LAFP: A Local Algorithm for Evaluating PDGs

The pseudo-code for algorithm LAFP is given in Figure 1. LAFP takes as input a PDG G = (V, E, V1 . . . Vn , σ) and a distinguished vertex x0 ∈ V , and decides whether x0 ∈ φ(g0 (⊥)); that is, whether x0 is in the solution to G. Before explaining further the algorithm, we need some additional notation. Let Q+ = {x ∈ Q | x ∈ Vi and σ(Vi ) = ν} be the vertices in Q defined in blocks of type ν and, similarly, let Q− = {x ∈ Q | x ∈ Vi and σ(Vi ) = µ} be the vertices in Q defined in blocks of type µ. By default, vertices of Q+ are assumed to be in the solution to G while vertices of Q− are not. Also, we write y > x when the index of the block containing vertex y is greater than the index of the block containing vertex x; i.e., y is in a block more deeply nested than the block containing x. Like the algorithm of [VL94], LAFP seeks to construct a stable and complete search space (subset of V ) in the sense that PDG vertices belonging to the search space depend only upon vertices inside the search space. Moreover, it partitions the search space into three blocks I, O, and Q. I contains those vertices currently considered to be inside the solution, O contains those vertices currently considered to be outside the solution, and Q is the set of vertices that have been explored but whose status is undetermined. The algorithm starts with x0 in Q, terminates when Q is empty, and each iteration of the while-loop is designed to maintain the invariants given in the proof sketch of Theorem 1. In particular, a vertex x is chosen from Q from among those that are most deeply nested (in the block with the largest index). This is to prevent computation in an outer block (relative to x’s block) from proceeding with possibly erroneous default values. In case 1, x is a vertex that belongs in I since one of x’s target sets of vertices S is contained in Q+ ∪ I. In this case, x is moved from Q to I; the fact that S is only required to be contained in Q+ ∪ I rather than in I reflects the intuition that vertices from a ν-block are assumed to be in the solution set. Subsequently, a check is performed to see if x is from a µ-block. If so, then all nodes in O that transitively depend on the assumption that x is not in the solution (since

10

procedure LAFP(G, x0 ) initialize I := ∅, O := ∅, Q := {x0 } while Q 6= ∅ do choose x ∈ Q ∩ Vk where k is the largest k such that Q ∩ Vk 6= ∅ case 1. x ∈ g(Q+ ∪ I): I := I ∪ {x} Q := Q − {x} choose (x, S) ∈ E such that S ⊆ Q+ ∪ I Closure1 (x, S) if σ(x) = µ then Q := Q ∪ {y | y ∈ O, x ∈ y.T } O := {y ∈ O | x 6∈ y.T } 2. x ∈ g¯(Q− ∪ O): O := O ∪ {x} Q := Q − {x} T := ∅ for each (x, S) ∈ E do choose y ∈ S ∩ (Q− ∪ O) T := T ∪ {y} Closure0 (x, T ) if σ(x) = ν then Q := Q ∪ {y | y ∈ I, x ∈ y.T } I := {y ∈ I | x 6∈ y.T } 3. otherwise: S choose y ∈ {S | (x, S) ∈ E} such that y 6∈ Q ∪ I ∪ O Q := Q ∪ {y} procedure Closure1 (x, S) x.T := S do the following until x.T stops increasing if y ∈ x.T and (σ(x) = µ or y > x) then x.T := x.T ∪ y.T procedure Closure0 (x, S) x.T := S do the following until x.T stops increasing if y ∈ x.T and (σ(x) = ν or y > x) then x.T := x.T ∪ y.T

Fig. 1. Pseudo-code for algorithm LAFP.

11

x is in a µ-block) are moved from O to Q, a process we refer to as our restore strategy. For this purpose, we associate with each vertex y ∈ I ∪ O an attribute y.T , which is the set of vertices y transitively depends on for being in I or O. y.T is computed by the procedure Closure1 upon adding y into I. Case 2 is dual to case 1: each of x’s target sets has an element in Q− ∪ O. In case 3, there is not enough information to place x in I or O, so one of its unexplored successors is added to Q. It is easy to show that case 3 is always executable when both cases 1 and 2 fail to hold. In procedure Closure1 , the attribute set x.T is constructed. Assume, for the purposes of discussion, that we are computing x.T for some x which has just been added into I (the explanation of Closure0 is dual if x has just been added to O). Then x.T should contain vertices in I and Q+ on which x’s membership in I depends. (Later, we will see that an invariant property of LAFP is that, in this case, x.T ⊆ I ∪ Q+ .) Thus if y ∈ x.T and y is from a µ-block then y must be in I. Also, if y ∈ x.T and y is from a block more deeply nested than the block containing x, then also y must be in I (otherwise x would not have been evaluated in the first place). In these cases, since x ∈ I depends on y ∈ I which in turn depends on all the vertices in y.T , y.T must be a subset of x.T . Example 2. Consider PDG G of Example 1. If we want to determine whether x ∈ g0 (⊥), we run LAFP with Q = {x} initially. There are many possible runs of the algorithm on this instance. One of these is as follows: y is added into Q (case 3 on x); x is moved from Q to I (case 1 on x); y is moved from Q to I (case 1 on y); terminate with I = {x, y}, O = ∅, Q = ∅. Another possible run is as follows: z is added into Q (case 3 on x); y is added into Q (case 3 on z); z is moved from Q to I (case 1 on z); y is moved from Q to I (case 1 on y); x is moved from Q to I (case 1 on x); terminate with I = {x, y, z}, O = ∅, Q = ∅. The above example shows that in some cases LAFP may terminate without exploring all the vertices, a characteristic of local algorithms. The next example illustrates LAFP’s restore strategy. Example 3. Let G = (V, E, V1 V2 , σ) be a PDG where V = {x, y, z}, V1 = {x, y}, V2 = {z}, E = {(y, {x}), (y, {z}), (z, {x}), (z{y})}, σ(V1 ) = ν, σ(V2 ) = µ. The corresponding nested boolean equation system is the following:  x=0 ν: y =x∨z µ: z =x∨y If we want to determine whether z ∈ g0 (⊥), we run the algorithm with Q = {z} initially, and the following is a possible execution: x is added into Q (case 3 on z); z is moved from Q to I with z.T = {x} (case 1 on z); x is moved from Q to O with x.T = ∅, and z is moved from I back to Q since x ∈ z.T (case 2 on x); y is added into Q (case 3 on z); z is moved from Q to I with z.T = {y} (case 1 on z); y is moved from Q to I with y.T = {y, z} (case 1 on y); terminate with I = {z, y}, O = {x}, Q = ∅.

12

The (partial) correctness of LAFP is guaranteed by the following theorem. Theorem 1. When algorithm LAFP terminates, whenever x ∈ I then x ∈ φ(g0 (⊥)), and whenever x ∈ O then x ∈ φ(g0 (⊥)). Proof sketch The proof depends on the following key invariants of the whileloop: 1. 2. 3. 4. 5. 6.

if if if if if if

x ∈ I then x ∈ g(x.T ) and x.T ⊆ I ∪ Q+ , x ∈ O then x ∈ g¯(x.T ) and x.T ⊆ O ∪ Q− , x ∈ I ∩ Vk and σ(Vk ) = ν then x ∈ gk (φ− (x.T ))(k), x ∈ I ∩ Vk and σ(Vk ) = µ then x ∈ gk−1 (φ− (x.T ))(k), ¯k (φ− (x.T ))(k), x ∈ O ∩ Vk and σ(Vk ) = µ then x ∈ g ¯k−1 (φ− (x.T ))(k). x ∈ O ∩ Vk and σ(Vk ) = ν then x ∈ g

Now suppose after LAFP terminates x ∈ I. Clearly x ∈ g(x.T ) ⊆ g(I ∪ Q+ ) by the above invariants. When LAFP terminates Q = ∅, thus x ∈ g(I), that is x ∈ φ(gn (φ− (I))). Note that g0 (φ− (I)) = g0 (⊥). To conclude x ∈ g0 (⊥) we will show that at termination it holds that gk (φ− (I)) v gk−1 (φ− (I)) for k = 1, . . . , n. To see this we need to consider two cases. The first is that Vk is a µ-block. In this case for all y ∈ φ− (I)(k) it holds that y ∈ gk−1 (φ− (y.T ))(k) ⊆ gk−1 (φ− (I))(k), by invariants 4 and 1. Now gk (φ− (I)) v gk (φ− (I)[gk−1 (φ− (I))(k)/k]) = gk−1 (φ− (I)). The second case is that Vk is a ν-block. In this case for all y ∈ φ− (I)(k) it holds that y ∈ gk (φ− (y.T ))(k) ⊆ gk (φ− (I))(k), by invariants 3 and 1. So gk (φ− (I)) v gk (φ− (I)[gk (φ− (I))(k)/k]). This inequality shows that gk (φ− (I)) is a pre-fixed point of λu.gk (φ− (I)[u(k)/k]), thus gk (φ− (I)) v νu.gk (φ− (I)[u(k)/k]) = gk−1 (φ− (I)). For x ∈ O, we can similarly show that after termination x ∈ φ(¯ g0 (⊥)). Thus ¯ 0 (⊥) = g0 (⊥). t u in this case x ∈ φ(g0 (⊥)) since g In analyzing the computational complexity of LAFP, the concept of alternation depth plays an important role. Let G = (V, E, V1 . . . Vn ,σ) be a PDG. For x ∈ V , let succ(x) be the set of vertices that are related to x by the transitive closure of G’s hyper-edge relation. More precisely succ(x) is the smallest set such that if (x, S) ∈ E then S ⊆ succ(x) and if y ∈ succ(x) and (y, T ) ∈ E then T ⊆ succ(x). For x ∈ Vk , its alternation depth, ad (x), is defined by ad (x) = 1 + max{ad (y) | y ∈

k−1 [

Vi , y ∈ succ(x), σ(x) 6= σ(y)}.

i=1

We adopt the convention that max ∅ = 0. Thus clearly for x ∈ V1 , ad (x) = 1. Then for the PDG G its alternation depth is the maximum alternation depth of the vertices. The following theorem gives the fixed-point iteration complexity of LAFP. Theorem 2. Let G = (V, E, V1 . . . Vn , σ) be a PDG with x0 a distinguished vertex in V . Then the number of iterations taken by the while-loop of LAFP to decide if x0 ∈ φ(g0 (⊥)) is bounded by

13

 (|V | − 1) +

|V | + ad ad

ad

where ad is the alternation depth of G. Proof sketch Elements of the set I ∪ O can be partitioned into the following two subsets: A = {x | x ∈ I ∧ σ(x) = µ} ∪ {x | x ∈ O ∧ σ(x) = ν}, B = {x | x ∈ I ∧ σ(x) = ν} ∪ {x | x ∈ O ∧ σ(x) = µ}, and elements of A and of B are said to be alternating and straight , respectively. A can be further partitioned into A1 , . . . , Aad , where Ad = {x ∈ A | ad (x) = d}. The key to the complexity analysis is the pattern by which vertices move among these sets during the execution of LAFP. The pattern is characterized by the following observations: 1. if case 1 or 2 is executed, the size of the set I ∪ O ∪ Q does not change, whereas if case 3 is executed it increases by 1; 2. if case 3 is executed all A1 , . . . , Aad , B remain unchanged; 3. if case 1 or 2 is executed, then a new element x is added into I ∪ O either as an alternating or as a straight element. If x becomes a straight element of I ∪ O then |B| increases by 1 and all A1 , . . . , Aad remain unchanged, and if x becomes an alternating element of I ∪ O then |Ad | increases by 1 and Ai remains unchanged for i < d, where d = ad (x). With these observations, the lexicon order of the array (|A1 |, . . . , |Aad−1 |, |I ∪ O∪Q|+|B ∪Aad |) increases at least by 1 after each iteration. Routine calculation shows that this order is bounded by  (|V | − 1) +

|V | + ad ad

ad .

t u A careful amortized analysis of the total execution time of LAFP (in which the time taken during iterations of the while-loop is taken into account) introduces a factor of |V |2 into the bound of Theorem 2. This additional factor is mainly due to the computation performed by procedure Closure, and is the price we pay for being able to perform local model checking on structures of arbitrary alternation depth. However, the complexity of LAFP does not appear to be an issue in practice, as the algorithm performs extremely well on published benchmarks, in particular, those involving formulas of alternation depth 2 (see Section 4). It is not difficult to see that in the worst case LAFP requires space quadratic in the size of the explored state space; this is due to the maintenance of the y.T attribute sets, each of which can potentially grow to size O(|V |) after performing the Closure operation. In contrast, most existing model checking algorithms for the modal mu-calculus need only linear space. However, we strongly conjecture

14

that there exists a version of LAFP in which the Closure operation is avoided and PDG fixed-points are still computed correctly. Moreover, it should be possible to do so without affecting LAFP’s iteration complexity. This would yield the desired linear space complexity bound. One possible way of achieving this space complexity is by storing S and T in x.T instead of their “closure,” in cases 1 and 2 of procedure LAFP, respectively. If these changes are made, then care must be taken to ensure that the restore strategy properly propagates the effect of moving a node from O to Q or from I to Q. To clarify, consider an example. Suppose x is a node in a µ block and y, z ∈ O with y.T = {x}, z.T = {y}. Then, if x turns out to be in I, the restore strategy should not only move y from O back to Q (since x ∈ y.T ), but also z since z.T = {y} implies that z ∈ O depends on y ∈ O.

4

Experimental Results

We describe a prototype implementation of LAFP based on the XMC model checker [RRR+ 97] and the smodels stable models generator [NS96]. XMC is an efficient model checker for value-passing CCS and the alternation-free fragment of the modal mu-calculus, implemented using the XSB logic programming system [XSB97]. XSB implements tabled (SLG) resolution which effectively computes minimal models of bounded term-depth programs (which include Datalog programs). Furthermore, XSB’s evaluation strategy is goal-directed, which enables us to directly implement local model checking algorithms. For normal logic programs (i.e., programs with negated literals on the right-hand side of clauses), XSB computes the well-founded model: a three-valued model where each literal is given one of the three truth assignments true, false or unknown. For instance, consider the program: p :- q, s. q :- ¬ r. r :- ¬ q. s. The well-founded model for the above program is such that p, q and r are unknown and s is true. While evaluating the well-founded model XSB computes a residual program that represents the dependencies between literals with unknown values. For the above program, XSB computes the dependencies as p :- q. q :- ¬ r. r :- ¬ q. XMC was constructed starting with a straightforward encoding in Horn clauses of the structural operational semantics of value-passing CCS and the natural semantics of the modal mu-calculus. These rules were then subjected to a series of optimizing transformations, yielding a logic program. The XSB system is then used to efficiently evaluate the resulting logic program, over a

15

database of facts representing the process and formula definitions for the given model-checking instance. In XMC, the ability of XSB to compute minimal models is exploited directly to compute least fixed-point formulas. Formulas with greatest fixedpoint operators are transformed using the well known equivalence νX.F (X) ≡ ¬µX.¬F (¬X). For an alternation-free formula, the resultant XSB program is dynamically stratified (i.e., there are no loops through negation in the dynamic call graph), and the well-founded model computed by XSB has no unknown values [SSW96]. The literals encountered while evaluating the XSB program correspond directly to the vertices of the PDG representing the model-checking problem. For formulas without alternation, XSB assigns unique truth values to the vertices of the PDG as and when the PDG is constructed. For formulas with alternation, however, the resultant evaluation is not dynamically stratified, and hence the well-founded model contains literals with unknown values. That is, while XSB-based evaluation constructs the PDG, it does not label every vertex in the PDG as true or false. For such formulas, the residual program produced by XSB’s evaluation captures the subgraph of the PDG induced by vertices that do not have assigned truth values. We compute the truth values of these remaining vertices by invoking the stable model generator smodels [NS96] on the residual program. The algorithm used in smodels recursively assigns truth values to literals until all literals have been assigned values, or an assignment is inconsistent with the program rules. When an inconsistency is detected, it backtracks and tries alternate truth assignments for previously encountered literals. By appropriately choosing the order in which literals are assigned values, and the default values, we obtain an algorithm that corresponds to the LAFP algorithm with a naive restore operation. A full implementation of the LAFP algorithm in this framework is currently underway. In order to gauge the performance of our implementation of LAFP, we compared it to the Fixpoint Analysis Machine (FAM) [SCK+ 95] and a “conventional model checker” (CMC) on a benchmark described in [SCK+ 95]. The conventional model checker in question is an implementation of the [CKS92] model checking algorithm. The processes and formula comprising the benchmark are shown in Figure 2, along with the corresponding execution times of the three model checking systems. Performance figures for CMC and FAM are from [SCK+ 95]; these results as well as those for LAFP were obtained on a SUN Sparc-20. The formula F is a modal mu-calculus formula of alternation depth 2 expressing the property that an a-transition is enabled infinitely often along all infinite paths. It is true for state v of process Mk and false for all other states of Mk . Although the example is fairly simple in structure, it is essentially the only published benchmark for the alternation-depth-n fragment of the modal mu-calculus, n ≥ 2, of which we are aware. Note that the CMC and FAM figures reflect the performance of global algorithms. Hence, for purposes of comparison, the LAFP results were obtained as the sum of run times for verifying the given formula on each state in the process. For the above examples, the residual programs created by the first phase of

16

b

s

c

t1 a

a

tk

a

u

a

b

(a) Process Mk νX.µY.([−].(haitt ∧ X) ∨ Y ) (b) Formula F

Benchmark Tool Time (sec) M500 , F CMC 33.84 FAM 2.88 LAFP 1.61 M1000 , F CMC 138.51 FAM 11.64 LAFP 2.76 M1500 , F CMC 312.10 FAM 26.61 LAFP 4.08 (c) Summary of Execution Times

Fig. 2. Experimental evaluation of LAFP.

v

a

17

XMC-based model checker are relatively small. Therefore, the more expensive (potentially exponential) computation is performed on a very small portion of the state space. This is reflected in the performance of LAFP, which exhibits much slower growth in run times with increase in the size of the system verified, compared to those of the other implementations. We are currently performing a more comprehensive evaluation of the performance of the LAFP algorithm and its implementation.

5

Conclusions

We have presented an abstract model of nested, alternating fixed-point computation, and an algorithm for evaluating PDG fixed points. Careful design of LAFP has resulted in a local algorithm whose asymptotic fixed-point iteration complexity matches that of the best existing global algorithms. Moreover, LAFP has a simple correctness proof and performs extremely well in practice. It is interesting to note that algorithm LAFP correctly evaluates the input PDG for any I, O, and Q satisfying the invariants of given in the proof sketch of Theorem 1. This suggests an incremental approach, along the lines of [SS94], for the local computation of alternating fixed points. The incremental version of LAFP would be invoked after LAFP is run on a PDG that subsequently undergoes a set ∆ of changes, where a change is an inserted or deleted PDG edge. After accounting for the immediate effects of ∆ on I, O, and Q, the local fixed-point computation would be restarted. The benefit of this approach is that, in certain cases, the incremental algorithm will terminate much more quickly compared to restarting LAFP from scratch, thereby avoiding significant redundant recomputation. Working out the details of such an incremental algorithm is an important direction for future work, especially in the context of interactive design environments for concurrent systems.

A

Counterexample to the Correctness of [VL94] Restore Strategy No. 4

As mentioned in the Introduction, we have found a counterexample to the correctness of the local model checking algorithm of [VL94], when their “restore strategy” no. 4 is used. The details of the counterexample are as follows; please refer to [VL94] for a description of the algorithm. When procedure AltSolve is used in conjunction with Restore strategy no. 4, it may give an incorrect answer for the following boolean equation system:  x=u∨v µ: y = 1 u = v∧y ν: v =u∧y This is an alternating equation system with a minimum outer block and a maximum inner block, and it is not difficult to see that the solution should be 1 for

18

every variable. If AltSolve is run with Restore (4) on this example starting with x, the following computation sequence may occur: – – – – – – –

x is set to 0 (default value for a min variable) u is set to 1 (as a result of Expand1 , default value for a max variable) v is set to 1 (Expand2 , default value for a max variable) y is set to 0 (Expand2 , default value for a min variable) u is set to 0 (U pdate2 ) v is set to 0 (U pdate2 ) y is set to 1 (U pdate1 , here Restore (4) does not change u, v since the righthand sides of their equations still give value 0 even with y being 1).

AltSolve now terminates with y = 1, x = u = v = 0.

References And94. BC96a.

BC96b.

CE81.

CES86.

CKS92.

Cle90. CW96. EL86.

Koz83.

H. R. Andersen. Model checking and boolean graphs. Theoretical Computer Science, 126(1), 1994. G. S. Bhat and R. Cleaveland. Efficient local model checking for fragments of the modal µ-calculus. In T. Margaria and B. Steffen, editors, Proceedings of the Second International Workshop on Tools and Algorithms for the Construction and Analysis of Systems (TACAS ’96), Vol. 1055 of Lecture Notes in Computer Science, pages 107–126. Springer-Verlag, March 1996. G. S. Bhat and R. Cleaveland. Efficient model checking via the equational µ-calculus. In E. M. Clarke, editor, 11th Annual Symposium on Logic in Computer Science (LICS ’96), pages 304–312, New Brunswick, NJ, July 1996. Computer Society Press. E. M. Clarke and E. A. Emerson. Design and synthesis of synchronization skeletons using branching-time temporal logic. In D. Kozen, editor, Proceedings of the Workshop on Logic of Programs, Yorktown Heights, volume 131 of Lecture Notes in Computer Science, pages 52–71. Springer-Verlag, 1981. E. M. Clarke, E. A. Emerson, and A. P. Sistla. Automatic verification of finite-state concurrent systems using temporal logic specifications. ACM TOPLAS, 8(2), 1986. R. Cleaveland, M. Klein, and B. Steffen. Faster model checking for the modal mu-calculus. In G.v. Bochmann and D.K. Probst, editors, Proceedings of the Fourth International Conference on Computer Aided Verification (CAV ’92), Vol. 663 of Lecture Notes in Computer Science, pages 410–422. Springer-Verlag, 1992. R. Cleaveland. Tableau-based model checking in the propositional mucalculus. Acta Informatica, 27(8):725–747, September 1990. E. M. Clarke and J. M. Wing. Formal methods: State of the art and future directions. ACM Computing Surveys, 28(4), December 1996. E. A. Emerson and C.-L. Lei. Efficient model checking in fragments of the propositional mu-calculus. In Proceedings of the First Annual Symposium on Logic in Computer Science, pages 267–278, 1986. D. Kozen. Results on the propositional µ-calculus. Theoretical Computer Science, 27:333–354, 1983.

19 LBC+ 94. D. E. Long, A. Browne, E. M. Clarke, S. Jha, and W. R. Marrero. An improved algorithm for the evaluation of fixpoint expressions. In D. Dill, editor, Proceedings of the Sixth International Conference on Computer Aided Verification (CAV ’94), Vol. 818 of Lecture Notes in Computer Science. Springer-Verlag, 1994. Liu92. X. Liu. Specification and Decomposition in Concurrency, Technical Report No. R 92-2005. PhD thesis, Department of Computer Science, Aalborg University, 1992. NS96. I. Niemela and P. Simons. Efficient implementation of the well-founded and stable model semantics. In Joint International Conference and Symposium on Logic Programming, pages 289–303, 1996. Pra81. V.R. Pratt. A decidable mu-calculus. In Proceedings of the 22nd IEEE Ann. Symp. on Foundations of Computer Science, Nashville, Tennessee, pages 421–427, 1981. QS82. J. P. Queille and J. Sifakis. Specification and verification of concurrent systems in Cesar. In Proceedings of the International Symposium in Programming, volume 137 of Lecture Notes in Computer Science, Berlin, 1982. Springer-Verlag. RRR+ 97. Y. S. Ramakrishna, C. R. Ramakrishnan, I. V. Ramakrishnan, S. A. Smolka, T. W. Swift, and D. S. Warren. Efficient model checking using tabled resolution. In Proceedings of the 9th International Conference on Computer-Aided Verification (CAV ’97), Haifa, Israel, July 1997. Springer-Verlag. RS97. Y. S. Ramakrishna and S. A. Smolka. Partial-order reduction in the weak modal mu-calculus. In A. Mazurkiewicz and J. Winkowski, editors, Proceedings of the Eighth International Conference on Concurrency Theory (CONCUR ’97), volume 1243 of Lecture Notes in Computer Science, Warsaw, Poland, July 1997. Springer-Verlag. SCK+ 95. B. Steffen, A. Classen, M. Klein, J. Knoop, and T. Margaria. The fixpointanalysis machine. In I. Lee and S. A. Smolka, editors, Proceedings of the Sixth International Conference on Concurrency Theory (CONCUR ’95), Vol. 962 of Lecture Notes in Computer Science, pages 72–87. Springer-Verlag, 1995. SS94. O. Sokolsky and S. A. Smolka. Incremental model checking in the modal mucalculus. In D. Dill, editor, Proceedings of the Sixth International Conference on Computer Aided Verification (CAV ’94), Vol. 818 of Lecture Notes in Computer Science. Springer-Verlag, 1994. SSW96. K. Sagonas, T. Swift, and D.S. Warren. An abstract machine to compute fixed-order dynamically stratified programs. In International Conference on Automated Deduction (CADE), 1996. SW91. C. Stirling and D. Walker. Local model checking in the modal mu-calculus. Theoretical Computer Science, 89(1), 1991. VL94. B. Vergauwen and J. Lewi. Efficient local correctness checking for single and alternating boolean equation systems. In Proceedings of ICALP’94, pages 304–315. LNCS 820, 1994. Win89. G. Winskel. A note on model checking the modal ν-calculus. In Proceedings of ICALP ’89, Vol. 372 of Lecture Notes in Computer Science, 1989. XSB97. XSB. The XSB logic programming system v1.7, 1997. Available by anonymous ftp from ftp.cs.sunysb.edu.

Modular Model Checking of Software Karen Laster and Orna Grumberg Computer Science Department The Technion Haifa 32000, Israel {laster,orna}@cs.technion.ac.il phone: 972-4-8294327 fax: 972-4-8221128 Abstract. This work presents a modular approach to temporal logic model checking of software. Model checking is a method that automatically determines whether a finite state system satisfies a temporal logic specification. Model checking algorithms have been successfully used to verify complex systems. However, their use is limited by the high space requirements needed to represent the verified system. When hardware designs are considered, a typical solution is to partition the design into units running in parallel, and handle each unit separately. For software systems such a solution is not always feasible. This is because a software system might be too large to fit into memory even when it consists of a single sequential unit. To avoid the high space requirements for software we suggest to partition the program text into sequentially composed subprograms. Based on this partition, we present a model checking algorithm for software that arrives at its conclusion by examining each subprogram in separation. The novelty of our approach is that it uses a decomposition of the program in which the interconnection between parts is sequential and not parallel. We handle each part separately, while keeping all other parts on an external memory (files). Consequently, our approach reduces space requirements and enables verification of larger systems. Our method is applicable to finite state programs. Further, it is applicable to infinite state programs provided that a suitable abstraction can be constructed. We implemented the ideas described in this paper in a prototype tool called SoftVer and applied it to a few small examples. We have achieved reduction in both space and time requirements. We consider this work as a first step towards making temporal logic model checking useful for software verification.

1

Introduction

This work presents a new modular approach that makes temporal logic model checking applicable to large non-deterministic sequential finite-state programs, written in some high level programming language. B. Steffen (Ed.): TACAS 98 c Springer–Verlag Berlin Heidelberg 1998 LNCS 1384, pp. 20–35, 1998.

21

Finite-state programs can be useful for describing, in some level of abstraction, many interesting systems. They can describe the behavior of communication protocols. They can be used to describe expert systems, provided that some of the inputs are mapped into a finite domain. Such programs (written in behavioral Hardware Description Languages) are being used to describe the high level behavior of hardware designs. All these examples are reactive, i.e., they continuously interact with their environment. They are also quite complex which makes their verification an important and non-trivial task. Furthermore, even though they are sequential they might be significantly large. A first step in verification is choosing a specification language. Temporal logics [17], capable of describing behaviors over time, have proven to be most suitable for the specification of reactive systems. When restricted to finite-state systems, propositional temporal logic specifications [7] can be checked by efficient algorithms, called model checking [5,19,14,2]. Temporal logic model checking procedures typically receive a system model by means of a state transition graph and a formula in the logic, and determine the set of states in the model that satisfy the formula. Tools based on model checking [15] were successful in finding subtle bugs in real-life designs [16,6] and are currently in use by the hardware industry in the verification process of newly developed hardware designs [1,12]. Unfortunately, similar applications of model checking to programs are very limited. One reason for this deficiency arises from the fact that large hardware systems are usually composed of many components working in parallel. Software systems, on the other hand, can be extremely large even when they consist of one sequential component. A useful approach to reducing space requirement is modularity. Modular model checking techniques treat each component in separation, based on an assumption about the behavior of its environment [18,11,9]. Existing techniques, however, are based on partitioning the system into processes that run in parallel. Our work applies a modular approach to sequential programs. To do so, we suggest a way of partitioning the program into components, following the program text. A given program may have several different partitions. A partition of the program is represented by a partition graph, whose nodes are models of the subprograms and whose edges represent the flow of control between subprograms. Once the program is partitioned, we wish to check each part separately. However, verifying one component in isolation amounts to checking the specification formula on a model in which some of the paths are truncated, i.e. for certain states in the component we do not know how the computation proceeds (since the continuation is in another component). Such states are called ending states. We notice, however, that the truth of a formula at a state inside a component can be determined solely by considering the state transition graph of this component, and the set of formulas which are true at the ending states. Moreover, the truth of a formula at an ending state depends only on the paths leaving it, and not on the paths leading to it. This observation is the basis for our algorithm. We define a notion of assumption function that represents partial knowledge about the truth of formulas at ending states. Based on that, we define a semantics

22

under assumption that determines the truth of temporal formulas based on a given assumption function. Only minor changes are needed in order to adapt a standard model checking algorithm so that it performs model checking under assumptions. Given a procedure that performs model checking under assumptions, we develop a modular model checking algorithm that checks the program in parts. To illustrate how the algorithm works consider the program P = P1 ; P2 . We notice that every path of P lies either entirely within P1 or has a prefix in P1 followed by a suffix in P2 . In order to check a formula ψ on P , we first model check ψ on P2 . The result does not depend on P1 and therefore the algorithm can be applied to P2 in isolation. We next want to model check P1 , but now the result does depend on P2 . In particular, ending states of P1 have their continuations in P2 . However, each ending state of P1 is an initial state of P2 for which we have already the model checking result 1 . Using this result as an assumption for P1 , we can now model check P1 in isolation. Handling loops in the program is more complicated but follows a similar intuition. The suggested scheme saves significant amounts of space since at any given time the memory contains only the model of the component under consideration, together with the assumption function that maps formulas to the ending states of that component. Often it also saves time, since the model checking task is performed on substantially smaller models. Our modular algorithm can handle any finite-state while program with nondeterministic assignments. In addition to sequential composition, programs may include choices (“if-then-else”) and while loops, nested in any way. Works discussing model checking of programs written in a high level language are rare. The closest to our work are [8] that verifies concurrent systems written in C, and the SPIN system [10] that validates protocols. However, their approaches are not modular. Another related work is [3], in which they perform model checking on Pushdown Process Systems by considering the semantics of ’fragments’, which are interpreted as ’incomplete portions’ of the process. The model checking algorithm they propose calculates the property transformer of each fragment, which is a function that represents the semantics of a fragment with respect to alternation-free mu-calculus formulas. This algorithm, however, works on all fragments together. It should also be noted that Pushdown Process Systems are suitable for modeling (parallel) processes but they can hardly be considered as a high level programming language. In contrast, our work applies model checking to programs written in a high level programming language, while exploiting their textual structure in order to reduce space requirements. We consider our work as a first step in making model checking applicable to realistic software systems. We implemented the ideas described in this paper in a prototype tool called SoftVer. We applied the tool to a few small examples, each with different partitions and compared the space and time requirements needed for model checking with the space and time used when the program is unpartitioned. In all cases, 1

The result includes for each sub formula ϕ of ψ the set of states satisfying ϕ.

23

a substantial space reduction has been achieved. Furthermore, in five out of six cases a significant reduction in time has been obtained as well. In the concluding section we summarize these results and explain them. The paper is organized as follows. In section 2 we introduce the temporal logic CTL and define its semantics under assumptions. Section 3 describes the syntax and semantics of our programming language and Section 4 defines partition graphs. Section 5 gives the modular model checking algorithm. Finally, Section 6 describes the implementation and suggests directions for future research.

2 2.1

Basic Definitions Kripke Structures

Kripke structures are widely used for modeling finite-state systems. In this paper we use Kripke structures to model the behavior of a finite program. Definition 1 A Kripke Structure is a tuple M = hS, R, Ii s.t. S is a set of states, R ⊆ S × S is a transition relation and I ⊆ S is a set of initial states. A path in M from a state s0 is a sequence π = s0 , s1 , . . . s.t. ∀i[si ∈ S and (si , si+1 ) ∈ R]. A maximal path in M is a path which is either infinite, or ends in a state with no outgoing transitions. Let π be a maximal path in M . We write |π| = n if π = s0 , s1 , . . . , sn−1 and |π| = ∞ if π is infinite. Definition 2 For a Kripke structure M = hS, R, Ii we define the set of ending states to be: end(M ) = {s ∈ S | ¬∃s0 .(s, s0 ) ∈ R}. We also use init(M ) to refer to the set I of initial states. 2.2

CTL

For our specification language we use the propositional branching-time temporal logic CT L. It allows us to specify a behavior of a program in terms of its computation tree [4]. We assume a set of atomic propositions AP and a labeling function that associates with each state in a structure the set of atomic propositions true at that state. Throughout the paper we assume a fixed labeling function L : S → 2AP . We define a CT L formula to be either q for each q ∈ AP , or ¬f1 , f1 ∨ f2 , AXf1 , EXf1 , A(f1 Uf2 ), and E(f1 Uf2 ) where f1 and f2 are CT L formulas. Each temporal operator in CT L is constructed of a path quantifier, either A (”for all paths”) or E (”for some path”), and a temporal operator X or U. Intuitively, the operator X means ”at the next step”, so the formula AXq states that in all the paths outgoing from a given state, the second state satisfies q. A path satisfies p U q (p ”Until” q) if there exists a state along it that satisfies q and all the states preceding it satisfy p.

24

CT L formulas are usually interpreted over Kripke structures that have a total transition relation, so that all paths are infinite. We denote the standard semantics for CT L [7,4] as M, s |= ψ (meaning that the state s in the structure M satisfies ψ). In this paper we introduce an interpretation for CT L over a Kripke structure and an assumption function (defined below). The use of assumption functions enables us to give semantics (over infinite paths) in case of incomplete information. When a finite path occurs in a structure, we view it as a prefix of a set of infinite paths with unspecified continuations. The assumption function states which formulas are true over this absent continuation. We use this information only for states in end(M ), so the function may be defined only over some subset of S that includes end(M ). Definition 3 The closure of a formula ψ, cl(ψ), is the set of all the sub-formulas of ψ (including itself ). Definition 4 An assumption function for a Kripke structure M = hS, R, Ii is a 0 function As : cl(ψ) → (2S ∪ {⊥}) where S 0 ⊆ S. We require that end(M ) ⊆ S 0 and that ∀ϕ ∈ cl(ψ), if As(ϕ) 6= ⊥ then ∀ϕ0 ∈ cl(ϕ), As(ϕ0 ) 6= ⊥. For every ϕ ∈ cl(ψ), if As(ϕ) 6= ⊥ then As(ϕ) represents the set of all states in S 0 for which we assume (or know) that ϕ holds. For every state s ∈ S 0 s.t. s 6∈ As(ϕ) we assume that ¬ϕ holds. When As(ϕ) = ⊥ it means that we have no knowledge regarding the satisfaction of ϕ in S 0 . Satisfaction of a CT L formula ϕ in a state s ∈ S under an assumption function As is denoted (M, L), s |=As ϕ 2 . We define it so that it holds if either M, s |= ϕ directly (by infinite paths only), or through the assumption. For example, M, s |=As E(f Ug) if there exists an infinite path from s satisfying f in all states until a state satisfying g is reached, but it is also true if there is a finite path from s in which the last state, say s0 , satisfies s0 ∈ As(E(f Ug)), and all states until s0 satisfy f . Formally: Definition 5 Let M = hS, R, Ii be a Kripke structure and As an assumption function over M . For every ϕ ∈ cl(ψ): If As(ϕ) = ⊥ then s |=As ϕ is not defined. Otherwise, we differentiate between ending states and other states. If s ∈ end(M ) then s |=As ϕ iff s ∈ As(ϕ). If s ∈ S \end(M ) then s |=As ϕ is defined as follows: – – – – – 2

s |=As p iff p ∈ L(s) for every p ∈ AP . s |=As ϕ1 ∨ ϕ2 iff (s |=As ϕ1 or s |=As ϕ2 ). s |=As ¬ϕ1 iff s 6|=As ϕ1 . s |=As AXϕ1 iff ∀s0 .(s, s0 ) ∈ R ⇒ s0 |=As ϕ1 . s |=As EXϕ1 iff ∃s0 .(s, s0 ) ∈ R ∧ s0 |=As ϕ1 .

Since we assume a fixed L, we always omit L. When no confusion may occur we also omit M .

25

– s |=As A(ϕ1 Uϕ2 ) iff for all (maximal) paths π = s0 , s1 , . . . from s there is a number i < |π| s.t. (either si |=As ϕ2 or si ∈ end(M ) ∧ si |=As A(ϕ1 Uϕ2 )), and ∀0 ≤ j < i[sj |=As ϕ1 ]. – s |=As E(ϕ1 Uϕ2 ) iff there exist a (maximal) path π = s0 , s1 , . . . from s and a number i < |π| s.t. (either si |=As ϕ2 or si ∈ end(M ) ∧ si |=As E(ϕ1 Uϕ2 )) and ∀0 ≤ j < i[sj |=As ϕ1 ]. Note that, if the transition relation of M is total then the above definition is equivalent to the traditional definition of CT L semantics, because the assumption function is consulted only on states from which there are no outgoing transitions. 2.3

Model Checking Under Assumptions

The task of model checking is to find all initial states of a given structure that satisfy a formula ψ. We write M |=As ψ iff ∀s ∈ I, [M, s |=As ψ]. From here on we assume that ψ is the formula to be checked on a structure M = hS, R, Ii (or later, a program). Definition 6 Given an assumption function As over a structure M we define a function M C[M, As] : cl(ψ) → (2S ∪ {⊥}) so that for any ϕ ∈ cl(ψ), if As(ϕ) = ⊥ then M C[M, As](ϕ) = ⊥. Otherwise, M C[M, As](ϕ) = {s ∈ S | M, s |=As ϕ}. Notice that M C[M, As] results in an assumption function. Given M and As, this function can be calculated using any known model checking algorithm for CT L [5,19,2], after adapting it to the semantics under assumptions.

3

The Programming Language

Following we define the syntax and semantics of our programming language NWP (Non-deterministic While-Programs). Definition 7 We assume a fixed set of program variables over some finite domain D. A program fragment is one of x := {e1 , . . . , ek }, skip, P rog1 ; P rog2 , ”if B then P rog1 else P rog2 fi” or ”while B do P rog1 od” s.t. P rog1 ,P rog2 are program fragments, B is a boolean expression over program variables and constants, x stands for any program variable, and e is an expression over program variables and constants. The meaning of x:={e1 , . . . , ek } is a non-deterministic assignment, P rog1 ; P rog2 is the sequential composition of P rog1 and P rog2 , and the ”if” and ”while” structures have the same meaning as in all sequential programming languages. A full program is of the form P rog;fin where P rog is a program fragment. The meaning of ”fin” is an infinite loop that does not change the values of program variables. We define E to be the empty program, such that for every P ∈ NWP it holds that P ; E = E; P = P . The set NWP is the set of all full programs.

26

From here on we use the word ”program” to refer to either a full program, or a program fragment, unless stated otherwise. The semantics of NWP programs is given by means of Kripke structures. We give here only an informal description, the formal definition can be found in [13]. Let P ∈ NWP be a program such that x1 , . . . , xn are the program variables. An assignment to the program variables is some σ ∈ Dn . We create a Kripke structure struct(P ) so that each state is a pair (l, σ) where l is a program location and σ ∈ Dn is an assignment to the program variables. Each location is associated with the remaining program to be run from that point on. The transition relation is created in the intuitive way, following the usual semantics of the commands. Evaluating a boolean expression (in an ”if” or ”while” command) is considered a step in execution. We define the set of initial states init(P ) as the set of states with location P . The set of ending states, end(P ), is the set of states in struct(P ) that have no outgoing transition. If P is a full program then end(P ) = ∅. If P is a program fragment then this is the set of states with the location E (which means that there is nothing more to run). We add to AP the set {at l | l is a location in P }. The new propositions are used to refer to a location in the program within the specification. The labeling function L : S → 2AP is extended accordingly. Figure 1 includes an example of a NWP program, and its structure. init(struct(P))

struct(P)::

if a then b := true; else b := false; (P2)

P ::

(P) a b

(P) a !b

(P) !a b

(P) !a !b

(P1) a

(P1) a !b

(P1) !a b

(P1) !a !b

(P2) a b

(P2) a !b

(P2) !a b

(P2) !a !b

(E) a b

(E) a !b

(E) !a b

(E) !a !b

(P1)

fi;

Fig. 1. An example of an N W P program.

4

end(struct(P))

Partition Graphs

A Partition Graph of a program P is a finite graph representing a decomposition of P into several sub-programs while maintaining the original flow of control. The nodes are Kripke structures, each representing a sub-program of P or a boolean expression. A node representing a sub-program P 0 is of the form struct(P 0 ). A node representing a boolean expression B, has the form hS, R, Ii s.t. R = ∅ and S = I = {(l, σ) | σ ∈ Dn } where l is the program location of the ”if” or ”while” command that evaluates B.

27

There are three types of edges: null-edges, yes-edges, and no-edges, denoted yes no M1 → M2 , M1 → M2 and M1 → M2 respectively. A null edge M1 → M2 , where M1 = struct(P1 ) and M2 = struct(P2 ), means that init(P2 ) = end(P1 ). This happens when there is no step in the execution between the corresponding subprograms, for example, when the program to be executed is P1 ; P2 . Yes-edges and no-edges, called step-edges, are edges outgoing from a node representing a boolean expression. Execution from a state in this node continues through the yes-edge or the no-edge, depending on whether the expression evaluates to true or false in that state. These edges also represent a step in the execution. A partition graph also has two designated nodes: the entry node, from which execution starts, and the exit node, at which it stops. The set pg(P ) contains all possible partition graphs of P , representing different ways of partitioning P into sub-programs. It is defined recursively, where at each step one may decide to break a given program according to its primary structure, or to create a single node out of it. Figure 2 shows the three different ways in which a program may be decomposed, according to the three structures by which programs are created. We use in1 (in2 ) for the entry node of G1 (G2 ) and out1 (out2 ) for the exit node. 1. If P = P1 ; P2 we may decompose it into two parts, by creating (recursively) partition graphs G1 ∈ pg(P1 ) and G2 ∈ pg(P2 ), and connecting them with a null edge from out1 to in2 . The entry node of the resulting graph would be in1 , and the exit node would be out2 (Figure 2 A). 2. If P = ”if B then P1 else P2 fi”, we again create the two graphs G1 ∈ pg(P1 ) and G2 ∈ pg(P2 ) but also create two new nodes, one representing the boolean expression B and the other representing the empty program E. The Kripke structure representing E has no edges (an empty transition relation) and its set of states is the product of Dn and the location E. This node is used as the exit node, and the entry node is the B node. The edges connecting the different components are according to the semantics of the ”if” command. Again, the edges entering G1 and G2 are to in1 and in2 and the edges exiting G1 and G2 are from out1 and out2 . (Figure 2 B). 3. If P = ”while B do P1 od”, we create a partition graph G1 ∈ pg(P1 ) and again a node for B, which is the entry node, and an E node as the exit node. The edges represent the semantics of the ”while” loop. (Figure 2 C). The formal definition of partition graphs and their semantics (given as Kripke structures) can be found in [13]. It is defined so that given any partition graph G ∈ pg(P ), the structure that defines its semantics, denoted struct(G), is identical to struct(P ). Informally, struct(G) is created out of the union of all Kripke structures in its nodes (with some adjustment of the program locations). Each step-edge induces a set of transitions from the states in the node representing the boolean expression, to initial states in the node that is pointed at by the edge. A yes-edge (no-edge) creates one transition from each state that satisfies (does not satisfy) the condition into the corresponding state (different location, same assignment to variables). A null-edge M1 → M2 does not create transitions.

28 B

B

yes

no

no

E

yes

G1 G1

G1

G2

G2 E (A) P = P1;P2

(C) P = while B do P1 od

(B) P = if B then P1 else P2 fi

Fig. 2. Creation of partition graphs (P) !a b

(P) a !b

(P) a b

(P) !a !b

yes (P1) a b

(P1) a !b

(E) a b

(E) a !b

(E) a b

(fin) a b

no (P1) !a !b

(P1) !a b

(E) !a !b

(E) !a b

(P2) a b

(P2) a !b

(P2) !a b

(P2) !a !b

(E) a b

(E) a !b

(E) !a b

(E) !a !b

(E) a !b

(E) !a b

(fin) a !b

(fin) !a b

(E) !a !b

(fin) !a !b

Fig. 3. An example partition graph for the program P ;fin, where P is the program from figure 1. Given a partition graph G we define init(G) to be the set of initial states in struct(G) and end(G) to be the set of ending states in struct(G). Figure 3 gives an example of an actual partition graph.

5

Performing Modular Model Checking

Our algorithm for modular model checking is based on the notion of satisfaction under assumptions. Furthermore, the basic building block in the recursive definition of the algorithm is “model checking under assumptions”. We do not give here an explicit algorithm to compute it, we just note that every standard model checking algorithm for CT L can easily be adapted to handle assumptions. Before we present our modular algorithm we define a few operations on assumption functions that we use in the algorithm.

29

5.1

Operations on Assumption Functions yes

We first present an operation T that, given a step-edge e = MB → M1 or e = no MB → M1 (MB is a structure representing a condition B), and an assumption function As over the initial states of M1 , results in an assumption function As0 over MB . As0 is defined so that it represents all the knowledge that As gives, translated over the edge. yes

Definition 8 Let e = MB → M1 be an edge in a partition graph G s.t. M1 = hS1 , R1 , I1 i and MB = hSB , ∅, SB i, and let As : cl(ψ) → (2S1 ∪ {⊥}) be an assumption function over M1 . T (e, As) = As0 s.t. As0 : cl(ψ) → (2ST ∪ {⊥}). The set ST ⊆ SB is the set of states in SB that satisfy the condition B. This is exactly the set of states from which there will be an edge into a state of M1 in struct(G). Moreover, assume that l is the location of all the states in SB and l0 is the location of the states in I1 . Then the definition of struct(G) is such that from each state s = (l, σ) ∈ SB s.t. σ |= B there is exactly one transition, into a state s0 = (l0 , σ). As a result, there is no difference between “for all paths” and “there exists a path” and therefore the operators AXϕ and EXϕ are handled in exactly the same way, and so are the operators A(ϕ1 Uϕ2 ) and E(ϕ1 Uϕ2 ). If As(ϕ) = ⊥ then As0 (ϕ) = ⊥. Otherwise, As0 (ϕ) is defined as follows 3 – – – – –

For any p ∈ AP , As0 (p) = {s ∈ ST | p ∈ L(s)}. As0 (¬ϕ) = ST \ As0 (ϕ) As0 (ϕ1 ∨ ϕ2 ) = As0 (ϕ1 ) ∪ As0 (ϕ2 ) As0 (AXϕ) = As0 (EXϕ) = {(l, σ) ∈ ST | (l0 , σ) ∈ As(ϕ)} As0 (A(ϕ1 Uϕ2 )) = As0 (E(ϕ1 Uϕ2 )) = As0 (ϕ2 ) ∪ (As0 (ϕ1 ) ∩ {(l, σ) ∈ ST | (l0 , σ) ∈ As(A(ϕ1 Uϕ2 ))}) no

For a no-edge MB → M1 the definition is the same, replacing every use of ST by SF which is the set of states that do not satisfy B. An important feature of this operation is that if the original assumption coincides with the truth of formulas in the structure of G then the derived assumption also coincides with the truth of formulas in the structure. The proof of this is omitted due to space restrictions. 5.2

The Compositional Algorithm

Following, we give an algorithm to check a formula ψ on a partition graph G of a full program P . The result is an assumption function over the set of initial states of P that gives, for every sub-formula ϕ of ψ, the set of all initial states of P satisfying ϕ. We start with an intuitive description of the algorithm. The algorithm works on G from the exit node upwards to the entry node. First the structure contained in a leaf node V of G is model checked under an ”empty” assumption for cl(ψ), an assumption in which all values are ∅. Since 3

If As(ϕ) 6= ⊥ then for all sub-formulas ϕ0 of ϕ it holds that As(ϕ0 ) 6= ⊥.

30

V is a leaf it must represent a full program and therefore all paths in it are infinite, and the assumption function has no influence on the result. The result of the model checking algorithm is an assumption function As0 that associates with every sub-formula of ψ the set of all initial states of V that satisfy that sub-formula. Once we have As0 on V we can derive a similar function As on the ending states of any node U , preceding V in G (that is, any node U from which there is an edge into V ). Next, we model check U under the assumption As. Proceeding this way, each node in G can be checked in isolation, based on assumptions derived from its successor nodes. Special care should be taken when dealing with loops in the partition graph. We now give an intuitive description of the algorithm CheckGraph (where variable names refer to variables in the algorithm). Given a procedure that properly computes M C[M, As], CheckGraph takes an assumption function As and a partition graph G and performs model checking under assumption resulting in an assumption As0 . The answer to the model checking problem is As0 (ψ). CheckGraph is able to handle partially defined assumption functions, in which there are some ⊥ values. For any sub-formula ϕ s.t. As(ϕ) = ⊥ we get As0 (ϕ) = ⊥. CheckGraph is defined by induction on the structure of G. The base case handles a single node, that may contain the Kripke structure of any program, by using the given model checking procedure. To model check a partition graph G of P = P1 ; P2 , as in figure 2 A, CheckGraph first checks G2 under As (see Figure 4). As1 is the result of this check (As1 is over the set init(G2 )). It then uses As1 as an assumption on the ending states of G1 and checks P1 w.r.t As1 . The second check returns for all ϕ ∈ cl(ψ) the set of all initial states of P1 (also initial states of P ) that satisfy ϕ, which is the desired result. the result

init( G1 ) 111111 000000 000000 111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 G2 111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 111111

000000 111111 init( G2 ) 000000 111111

(1)

G_1 1111111 0000000 0000000 1111111 0000000 1111111

0000000 end(1111111 G1) 0000000 1111111

As1(ψ) 000000 111111 000000 111111 init( G2) 000000 111111 000000 111111

(2)

111111 000000 000000 111111 000000 111111 000000 111111 000000 111111 000000 G1111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 111111 000000 end(111111 G1) 000000 111111 000000 111111 000000 init(111111 G1 ) 000000 111111

(3)

11111 00000 00000 11111

00000 11111 init( G1 ) 00000 11111

G1 end( G1)

(4)

Fig. 4. The operation of the algorithm on sequential composition. The gray area is the set of states that satisfy ψ. Let G be a partition graph of P = ”if B then P1 else P2 ”, as in figure 2 B. To check G we first check G1 and G2 , and then compute ‘backwards’ over the step-edges (using the function T ) to get the result for the initial states of G. The most complicated part of the algorithm is for the partition graph G of a program P = ”while B do P1 od”, as in figure 2 C. We start from the node ME , for which we have the assumption As. Walking backwards on the no-edge we use the function T to get an assumption As¬B over the initial states of G that satisfy ¬B. We now demonstrate the computation of E(ϕ1 Uϕ2 ). We assume

31

that As0 (ϕ1 ) and As0 (ϕ2 ) were already calculated. The goal is to mark all states that satisfy E(ϕ1 Uϕ2 ) (to create As0 (E(ϕ1 Uϕ2 )). Standard model checking algorithms would start by marking all states that satisfy ϕ2 , and then repeatedly move backwards on transitions and mark every state that has a transition into a marked state, and satisfies ϕ1 itself. We reconstruct this computation over the partition graph of P . For initial states of G that satisfy B we have no assumption regarding E(ϕ1 Uϕ2 ), so we mark all those that satisfy B and ϕ2 and keep them in InitB . Together with As¬B (E(ϕ1 Uϕ2 )) we have an initial estimate for As0 (E(ϕ1 Uϕ2 )) (kept in As0 (ϕk )). We now want to mark all the fathers in G of these states. Notice that init(G) = end(G1 ) so these fathers are inside G1 . Hence we continue from end(G1 ) backwards inside G1 until we arrive at init(G1 ). At this point, only the marks on states of init(G1 ) are kept (in T mp). The marks on all other states of G1 are not preserved. Notice that G1 itself may consist of more than one node, and the creation of T mp is done by a recursive call to CheckGraph. From T mp we can calculate a new estimate for As0 (E(ϕ1 Uϕ2 )). The whole process repeats itself since the body of a ”while” loop can be executed more than once. Obviously, it is essential that the states satisfying ϕ1 and ϕ2 be known before this process can be performed. Therefore, we use the ⊥ value for E(ϕ1 Uϕ2 ) when working on the assumptions for ϕ1 and ϕ2 . Only when calculations for all sub-formulas are completed, we may begin calculating the proper result for E(ϕ1 Uϕ2 ). This process stops when the assumption calculated reaches a fix-point (Asi = i−1 As ). Obviously, no new information will be revealed by performing another cycle. The set of states in init(G) that are marked increases with each cycle, until all states that satisfy the formula are marked, and the algorithm stops. Following is the recursive definition of the algorithm. Given a partition graph G ∈ pg(P ) of a program P, and an assumption As : cl(ψ) → (2end(G) ∪ {⊥}), CheckGraph(G, As) returns an assumption As0 : cl(ψ) → (2init(G) ∪ {⊥}). CheckGraph(G,As): The base case is for a single node M , in which case we return As0 s.t. ∀ϕ ∈ cl(ψ), if As(ϕ) = ⊥ then As0 (ϕ) = ⊥, otherwise As0 (ϕ) = M C[M, As](ϕ) ∩ init(M ). The three possible recursive cases are the ones depicted in Figure 2. We assume that in1 (in2 ) is the entry node of G1 (G2 ), MB is the structure in a ”B” node, and ME is the structure in an ”E” node. – For a sequential composition P1 ; P2 (Figure 2 A) perform: 1. As1 ←CheckGraph(G2 , As). 2. As0 ←CheckGraph(G1 , As1 ). 3. Return(As0 ) – For a graph of P = ”if B then P1 else P2 fi” (Figure 2 B) perform: 1. As1 ←CheckGraph(G1 , As). 2. As2 ←CheckGraph(G2 , As). yes 3. AsB ← T (MB → in1 , As1 ) no 4. As¬B ← T (MB → in2 , As2 )

32

5. For every formula ϕ ∈ cl(ψ), if AsB (ϕ) = ⊥ then define As0 (ϕ) = ⊥ 4 . Otherwise, As0 (ϕ) = AsB (ϕ) ∪ As¬B (ϕ) (Notice that the images of AsB and As¬B are disjoint). 6. Return As0 – For a graph of P = ”while B do P1 od” (Figure 2 C) perform: no 1. As¬B ← T (MB → ME , As) 2. Find an ordering ϕ1 , ϕ2 , . . . , ϕn of the formulas in cl(ψ) such that each formula appears after all of its sub-formulas. Set As0 (ϕi ) = ⊥ for all i. For k = 1, . . . , n perform step 3 to define As0 (ϕk ) 5 . 3. Perform one of the following, according to the form of ϕk : ϕk ∈ AP : As0 (ϕk ) ← {s ∈ init(G) | ϕk ∈ L(s)} ϕk = ¬ϕl : As0 (ϕk ) ← {s ∈ init(G) | s 6∈ As0 (ϕl )}. ϕk = ϕl ∨ ϕm : As0 (ϕk ) ← As0 (ϕl ) ∪ As0 (ϕm ). ϕk ∈ {AXϕl ,EXϕl }: (a) T mp ←CheckGraph(G1 , As0 ) yes be the set of transitions induced by the edge MB → (b) Let RM yes B → in1 in1 . As0 (ϕk ) ← As¬B (ϕk ) ∪ {s ∈ init(G) | ∀s0 ∈ init(G1 ), (s, s0 ) ∈ ⇒ (s |= B ∧ s0 ∈ T mp(ϕl ))} 6 . RM yes → in B

1

ϕk ∈ {A(ϕl Uϕm ), E(ϕl Uϕm )}: (a) Set i ← 1. InitB ← As0 (ϕm ) ∩ {s ∈ init(G) | s |= B}. The initial assumption function is As0 ← As0 . Initialize the value for ϕk : As0 (ϕk ) ← As¬B (ϕk ) ∪ InitB . (b) do: • T mp =CheckGraph(G1 , Asi−1 ) yes • AsiB ← T (MB → in1 , T mp) • Define Asi so that for all j < k, Asi (ϕj ) ← As0 (ϕj ) and Asi (ϕk ) ← AsiB (ϕk ) ∪ As¬B (ϕk ) • i←i+1 as long as Asi 6= Asi−1 . (c) As0 (ϕk ) ← Asi (ϕk ) 4. Return As0 .

Theorem 1 For any full program P , CT L formula ψ, partition graph G ∈ pg(P ) and empty assumption function As : cl(ψ) → {∅}, if As0 = CheckGraph(G, As) then for every ϕ ∈ cl(ψ) and s ∈ init(G), s ∈ As0 (ϕ) ⇔ s |= ϕ. 4 5 6

Since AsB and As¬B both originate from the same assumption function As, it holds that AsB (ϕ) = ⊥ ⇐⇒ As¬B (ϕ) = ⊥. Notice that when working on ϕk we have already calculated As0 for all of its subformulas. The definition is the same for AXϕl and EXϕl because for each state s ∈ init(G) there is exactly one state s0 ∈ init(G1 ) s.t. (s, s0 ) ∈ R yes . MB → in1

33

This theorem states that if we run the algorithm on a full program, with an empty assumption function, the resulting function will give us full knowledge about which formulas in cl(ψ) hold in the initial states of the program according to the standard semantics of CT L. The space requirements of our modular algorithm will usually be better than that of algorithms that need to have the full model in the direct memory. Our algorithm holds in the direct memory at any particular moment only the model for the subprogram under consideration at that time. In addition, it keeps an assumption function, which at its largest holds the results of performing model checking on this subprogram. This of course is equivalent to any model checking algorithm that must keep its own results. The time requirements depend on the model checking algorithm used for a single node and on the partition graph. However, experimental results show a save in time as well as space requirements, as described in Section 6.

6

Implementation and Future Research

We implemented the ideas described in this paper in a prototype tool called SoftVer. The tool is based on a BDD representation of models and on symbolic model checking [2]. In order to evaluate the effectiveness of partitioning on memory and time requirements, we applied the tool to a few small examples. Each example program has been checked with two different partitionings. The moderate partitioning divided the program into a few components, while the extensive partitioning further divided it into smaller components. For comparison we also checked the unpartitioned full program. The largest overhead occurs when applying our algorithm to a program in which the body of a while loop is partitioned. Therefore, all our examples include while loops which are divided by both partitionings. Figure 5 gives the space and time used by each partitioning as a percentage of the space and time used by the unpartitioned example. SPACE TIME Ex 1 Ex 2 Ex 3 Ex 1 Ex 2 Ex 3 No Partitioning 100% 100% 100% 100% 100% 100% Moderate Partitioning 47% 50% 64% 31% 59% 74% Extensive Partitioning 33% 34% 47% 18% 26% 176%

Fig. 5. Space and time requirements for three examples. Example 1 is a simulation of the “stop and wait” communication protocol. It consists of a large while loop whose body has two major parts, one for the sender and one for the receiver. The moderate partitioning separates the receiver and the sender into two components. The extensive partitioning further separates different tasks in each of the components. The specification we checked required

34

that the sender does not move to the next message before the current message has arrived at the receiver. Example 2 is a learning algorithm that learns a single term by examples. As in the previous example, the code is partitioned so that different tasks are put in separate components. The specification required that the algorithm will never give a false negative result, i.e. the algorithm does not make errors on inputs for which the term evaluates to true. Example 3 is the shortest of the three and it performs bubble sort on an array of 5 elements. This program consists of two nested while loops, with a single “if” statement in the body of the inner loop (that compares two adjacent elements). The moderate partitioning breaks the outer loop and the extensive partitioning breaks the inner loop as well. The specification states that the algorithm will terminate, and at that point the array will be sorted. As can be seen in the table, in all examples space reduction was achieved by both partitionings where further save was obtained with finer ones. More surprisingly, save in time was also obtained in five out of six partitionings. This is explained by the fact that BDD based model checking is polynomial in the size of the BDD representation. Thus, applying the check once to a large model requires significantly more time than applying the check many times to smaller models. The save obtained this way compensates for the overhead of the modular algorithm. In the extensive partitioning of Example 3, however, the resulting components were only slightly smaller than those of the moderate partitioning. Thus, in this case the reduction in component size could not compensate for the additional overhead. We consider a few directions for future research. One is to extend the language to include procedures and parallel composition. Another is to develop heuristics for optimal partitioning of the program text. Finally, we intend to apply SoftVer to large realistic examples.

Acknowledgment: We thank Sergio Campos for sharing with us his knowledge in compiling programs into Kripke structures. Arie Tal is also thanked for his help in the tool development.

References 1. I. Beer, S. Ben-David, C. Eisner, D. Geist, L. Gluhovsky, T. Heyman, A. Landver, P. Paanah, Y. Rodeh, and Y. Wolfstahl. Rulebase: Model checking at IBM. In Proc. of the 9th International Conference on Computer Aided Verification, LNCS vol. 1254, pages 480–484. Springer, June 1997. 2. J. R. Burch, E. M. Clarke, K. L. McMillan, D. L. Dill, and L. J. Hwang. Symbolic model checking: 1020 states and beyond. Information and Computation, 98(2):142– 170, June 1992. 3. Olaf Burkart and Bernhard Steffen. Pushdown processes: Parallel composition and model checking. LNCS 836, pages 98–113. Springer, 1994.

35 4. E. M. Clarke and E. A. Emerson. Synthesis of synchronization skeletons for branching time temporal logic. In Logic of Programs: Workshop, Yorktown Heights, NY, May 1981, volume 131 of Lecture Notes in Computer Science. Springer-Verlag, 1981. 5. E. M. Clarke, E. A. Emerson, and A. P. Sistla. Automatic verification of finitestate concurrent systems using temporal logic specifications. ACM Transactions on Programming Languages and Systems, 8(2):244–263, 1986. 6. E. M. Clarke, O. Grumberg, H. Hiraishi, S. Jha, D. E. Long, K. L. McMillan, and L. A. Ness. Verification of the Futurebus+ cache coherence protocol. Formal Methods in System Design, 6(2):217–232, March 1995. 7. E. A. Emerson and J. Y. Halpern. “Sometimes” and “Not Never” revisited: On branching time versus linear time. Journal of the ACM, 33:151–178, 1986. 8. P. Godefroid. Model checking for programming languages using VeriSoft. In Principle of Programming Languages, January 1997. 9. O. Grumberg and D.E. Long. Model checking and modular verification. ACM Trans. on Programming Languages and Systems, 16(3):843–871, 1994. 10. G. Holzmann. Design and Validation of Computer Protocols. Prentice-Hall International Editors, 1991. 11. B. Josko. Verifying the correctness of AADL-modules using model checking. In J. W. de Bakker, W.-P. de Roever, and G. Rozenberg, editors, Proceedings of the REX Workshop on Stepwise Refinement of Distributed Systems, Models, Formalisms, Correctness, volume 430 of Lecture Notes in Computer Science. SpringerVerlag, May 1989. 12. G. Kamhi, O. Weissberg, L. Fix, Z. Binyamini, and Z. Shtadler. Automatic datapath extraction for efficient usage of HDD. In Proc. of the 9th International Conference on Computer Aided Verification, LNCS vol. 1254, pages 95–106. Springer, June 1997. 13. Karen Laster and Orna Grumberg. Modular model checking of software. Technical report, Computer Science Dept., Technion. Can be found at: http://www.cs.technion.ac.il/users/orna/. 14. O. Lichtenstein and A. Pnueli. Checking that finite state concurrent programs satisfy their linear specification. In Proceedings of the Twelfth Annual ACM Symposium on Principles of Programming Languages, pages 97–107, January 1985. 15. K. L. McMillan. Symbolic Model Checking: An Approach to the State Explosion Problem. Kluwer Academic Publishers, 1993. 16. K. L. McMillan and J. Schwalbe. Formal verification of the Encore Gigamax cache consistency protocol. In Proceedings of the 1991 International Symposium on Shared Memory Multiprocessors, April 1991. 17. A. Pnueli. A temporal logic of concurrent programs. Theoretical Computer Science, 13:45–60, 1981. 18. A. Pnueli. In transition from global to modular temporal reasoning about programs. In K. R. Apt, editor, Logics and Models of Concurrent Systems, volume 13 of NATO ASI series F. Springer-Verlag, 1984. 19. J.P. Quielle and J. Sifakis. Specification and verification of concurrent systems in CESAR. In Proceedings of the Fifth International Symposium in Programming, 1981.

Verification Based on Local States

?

Michaela Huhn1 , Peter Niebert1 , and Frank Wallner2 1

2

Institut f¨ ur Informatik, Universit¨ at Hildesheim, Postfach 101363, D-31113 Hildesheim, Germany, {huhn, niebert}@informatik.uni-hildesheim.de Institut f¨ ur Informatik, Technische Universit¨ at M¨ unchen D-80290 M¨ unchen, Germany [email protected]

Abstract. Net unfoldings are a well-known partial order semantics for Petri nets. Here we show that they are well suited to act as models for branching-time logics interpreted on local states. Such local logics (in particular a distributed µ-calculus) can be used to express properties from the point of view of one component in a distributed system. Local logics often allow for more efficient verification procedures because – in contrast to interleaving branching-time logics – they do not refer to the entire space of global states. We reduce verification of local properties to standard model checking algorithms known for interleaving branchingtime logics. The key is to extract a finite (usually small), local transition system bisimilar to the complete unfolding. The construction is based on the finite prefix of a net unfolding defined by McMillan.

1

Introduction

Model checking is one of the most successful approaches to formal, automated verification of distributed systems. Model checking algorithms decide whether a finite state system meets its specification given in terms of a temporal logic formula. One of the causes of the state explosion problem limiting this approach is the representation of concurrency as interleaving. Recently proposed partial order methods [Pel93,GW91,Val91] avoid the exploration of the entire state space for model checking by reductions according to the partial order semantics of the system, where certain interleaving properties are preserved. Instead of reducing the interleaving model, verification can also be done directly on the partially ordered object: Net unfoldings3 [NPW80,Eng91] provide a partial order branching time semantics for Petri nets. McMillan [McM92] has shown how to use net unfoldings for efficient deadlock detection and reachability analysis of finite-state Petri nets. He described the construction of a “finite prefix” of the (usually infinite) unfolding containing every reachable global state. It was already observed by Esparza in [Esp94] that the McMillan prefix can be ?

3

This work was partially supported by: the SFB 342, Teilprojekt A3 of the DFG; and by the Human Capital and Mobility Cooperation Network “EXPRESS” (Expressivity of Languages for Concurrency). Also known as (branching) non-sequential processes.

B. Steffen (Ed.): TACAS 98 c Springer–Verlag Berlin Heidelberg 1998 LNCS 1384, pp. 36–51, 1998.

37

used for model checking S4 (the modal logic based on the reachability relation of the global state space without next-modalities). We show in this paper that a slight modification of McMillan’s construction is a very adequate basis for more expressive branching time logics interpreted on local states and that for model checking such logics algorithms known from corresponding interleaving logics can be used. Here we understand a local (prime) configuration as the representation of the view of a single component onto the system, taking into account that the individual components have only partial information on a system’s global state. Local logics allow to express partial order properties of distributed systems in a natural way, while the expression of properties, that refer to a certain interleaving of concurrent events, is neither impossible nor desired. For the linear time case, such logics have been investigated by Thiagarajan in [Thi94,Thi95] and Niebert [Nie95], local branching time logics were introduced in [LT87,LRT92]. We consider systems – described in terms of Petri nets – composed of sequential, nondeterministic subsystems, which synchronously communicate by means of common actions. As a logic we propose a distributed µ-calculus, interpreted solely at the local states of the contributing components. The basic operator is an indexed modality haiJ meaning “next a for the components i ∈ J”. Using fixpoints, local CTL-operators (cf. Sec.3) or the knowledge operator 2i from [LRT92] can be encoded. Thus, the distributed µ-calculus serves as a powerful low-level logic, in which other local branching time logics can be expressed. Besides considerations of its practical use for specification, the proposed logic is designed (i.e. restricted) in order to stay feasible for automatic verification. For good reasons we do not address the theoretical question of the overall expressiveness of the logic: the reference logics for the comparison with µ-calculi are monadic second order logics, but the monadic second order logic of net unfoldings (or prime event structures) can be shown to have a highly undecidable model-checking problem even for 1-safe Petri nets. The distributed µ-calculus corresponds directly to the sequential µ-calculus [Koz83] interpreted on the local configurations of the system’s unfolding. Since the (local) state space of the unfolding is in general infinite, our aim is to extract a bisimilar, finite-state representation of the unfolding. Such a representation can be immediately used by proved interleaving model checkers [CS93,CES86], yielding efficient automated verification. We show that for any local configuration of the system’s unfolding we find a bisimilar local configuration in the finite prefix – no matter whether we take McMillan’s original definition or the improved prefix construction given in [ERV96]. Thus the local configurations within the finite prefix can serve as the state space for the desired finite representation. But the proof does not indicate how to determine the transitions needed for the finite bisimilar representation without exploring the complete unfolding. The major problem to solve is to determine those transitions (leading to the direct local successors) that are not already present in the finite prefix but which must exist because the local states of the prefix serve as representatives also for local states in the unfolding far

38

beyond the finite prefix. We show how to find all direct local successors without extending the prefix any further.4 Since the resulting local transition system does not contain more states than the prefix contains events, the input for model checkers can be dramatically smaller than the transition system of the global state space. Nevertheless, during the construction of the local transition system we sometimes have to inspect global configurations contained in the prefix. Complexity considerations show that the representation of the algorithm given in Sec. 5 can be improved such that it never exceeds the costs of building the global state space times the number of transitions of the original net – which is at the same time the worst case bound of the size of the resulting transition system. The paper is structured as follows. In Section 2 we introduce basic definitions of our models. In Section 3 we introduce the distributed µ-calculus and its formal semantics, and illustrate its use in specification with examples. In Sections 4 and 5 we show how to use the finite prefix for constructing a finite local transition system on which conventional model checkers apply.

2

Distributed nets and their unfoldings

We begin with the indispensable basic definitions and the class of Petri nets that serve as our system models. For further details on nets, cf. [Rei85]. Petri nets. Let P and T be disjoint, finite sets of places and transitions, generically called nodes. A net is a triple N = (P, T, F ) with a flow relation F ⊆ (P ×T ) ∪ (T ×P ), which we identify with its characteristic function on the set (P ×T ) ∪ (T ×P ). The preset • x and the postset x• of the node x are defined as • x := {y ∈ P ∪ T | F (y, x) = 1} and x• := {y ∈ P ∪ T | F (x, y) = 1}. The preset (postset) of a set X of nodes is given by the union of the presets (postsets) of all nodes in X. We assume • x ∪ x• 6= ∅ for every node x. A marking of a net is a mapping P → IN. We call Σ = (N, M0 ) a net system with initial marking M0 if N is a net and M0 a marking of N . A marking M enables the transition t if M (p) ≥ 1 for each p ∈ • t. In this case the transition can occur, leading to the new marking M 0 , given by M 0 (p) = M (p)+ F (t, p)− F (p, t) t for every place p. We denote this occurrence by M −→ M 0 . If there exists a chain tn t1 t2 M0 −→ M1 −→ . . . −→ Mn then the sequence σ = t1 t2 . . . tn is called occurrence σ sequence and we write M0 −→ Mn . M is called a reachable marking of Σ if there σ exists an occurrence sequence σ, such that M0 −→ M . Two transitions t1 , t2 are concurrently enabled in M if M enables t1 , and t2 is enabled in M 0 , where M 0 (p) = M (p) − F (p, t1 ) for each p. A system is called sequential if no reachable marking concurrently enables two transitions. We will exclusively regard 1-safe systems, in which every reachable marking map each place to 0 or 1, and thus can be identified with the set of places it 4

Since a direct local successor in one component may require an enormous number of causal predecessors in another component, it is not clear in advance when a further extension is sufficient to decide on the existence of a local successor.

39

maps to 1, i.e., M ⊆ P for every reachable marking M . Safe net systems can be seen as a synchronization of several finite automata. In the following we will exploit this compositional view by introducing the notion of locations. Distributed net systems. Let {Σi = (Pi , Ti , Fi , Mi0 ) | i ∈ I} be a family of 1-safe, sequential net systems with pairwise disjoint sets Pi of places, indexed by a finite set I of locations. The distributed net system ΣI = (NI , M0 ) is the union of the subsystems Σi : P =

[

Pi ,

T =

i∈I

[

Ti ,

F =

i∈I

[

Fi ,

M0 =

i∈I

[

Mi0 .

i∈I

Clearly, ΣI is again 1-safe. The intended interpretation of such a system is a collection of sequential, non-deterministic processes with communication capabilities, namely the common transitions. We understand the common execution of a joint transition as a communication event. The location loc(x) of a node x is defined by loc(x) := {i ∈ I | x ∈ Pi ∪ Ti }. A simple distributed net system consisting of two subsystems is depicted in Fig. 1.

0011

location 2

c

A C b

D

a

111 000 000 111

d

⊥ d B location 1

∗ c

D

A

d

C

◦ C d

D c

D

∗

C

∗ e

B

◦ a

a ∗ b

A

C

D

◦ c

D

◦

C

C A

a

C

◦ a

B

e

Fig. 1. Distributed net

◦ c

B C B

Fig. 2. Branching process

Net unfoldings. In order to define a partial order semantics of the behaviour of a distributed net system, we consider net unfoldings, also known as branching processes. They contain information about both concurrency and conflict. Two nodes x1 , x2 of a net (P, T, F ) are in conflict, denoted x1 #x2 , if there exist two distinct transitions t1 , t2 such that • t1 ∩ • t2 6= ∅, and (t1 , x1 ), (t2 , x2 ) belong to the reflexive and transitive closure of F . If x#x, we say x is in selfconflict. An occurrence net [NPW80] is a net N = (B, E, F ) such that (1) for every b ∈ B, | • b| ≤ 1, (2) the irreflexive transitive closure ≺ of F is wellfounded and acyclic, i.e., for every node x ∈ B ∪ E, the set {y ∈ B ∪ E|y ≺ x} is finite and does not contain x, and (3) no element e ∈ E is in self-conflict. The reflexive closure  of ≺ determines a partial order, called causal relation. In occurrence nets we speak of conditions and events instead of places and transitions, respectively. Min(N ) denotes the minimal elements of N w.r.t. , and Max(X) the causally maximal elements of the set X of nodes.

40

Given two nets N1 , N2 , the mapping h : P1 ∪ T1 → P2 ∪ T2 is called a homomorphism if h(P1 ) ⊆ P2 , h(T1 ) ⊆ T2 , and for every t ∈ T1 the restriction of h to • t, denoted h|• t , is a bijection between • t and • h(t), and similar for h|t• . A branching process [Eng91] of a net system Σ = (N, M0 ) is a pair β = (N 0 , π) where N 0 = (B, E, F ) is an occurrence net and π : N 0 → N is a homomorphism, such that the restriction of π to Min(N 0 ) is a bijection between Min(N 0 ) and M0 and additionally for all e1 , e2 ∈ E: if π(e1 ) = π(e2 ) and • e1 = • e2 then e1 = e2 . Loosely speaking, we unfold the net N to an occurrence net N 0 , obeying the rules determined by the conditions for π, and labelling each node x of N 0 with the corresponding node π(x) of N . Referring to distributed net systems, the location loc(x) of a node x of N 0 is given by loc(x) = loc(π(x)). By EJ we denote the set of J-events, i.e., EJ := {e ∈ E | J ⊆ loc(e)}. For singleton locations J = {i} we abbreviate E{i} by Ei . Given two distinct branching processes β1 , β2 of Σ, we say that β1 and β2 are isomorphic if there exists a bijective homomorphism h : N1 → N2 , such that the composition π2 ◦ h equals π1 . If h is injective, such that h|Min(N1 ) is a bijection between Min(N1 ) and Min(N2 ), and furtheron B1 ⊆ B2 and E1 ⊆ E2 , we call β1 a prefix of β2 . Notice that a prefix is uniquely determined by its set of events or its set of conditions. In [Eng91] it is shown that a net system has a unique maximal branching process up to isomorphism, which we call the unfolding of Σ, and denote by Unf . Fig. 2 shows a prefix of the infinite unfolding of the net system drawn in Fig. 1. Configurations and Cuts. A configuration C of an occurrence net is a causally downward-closed, conflict-free set of events, i.e., for each e ∈ C: if e0  e then e0 ∈ C, and for all e, e0 ∈ C : ¬(e#e0 ). If Max(C) is a singleton, say {e}, we speak of the local configuration of e and denote it by ↓e. It is given by the set of all the preceding events, i.e., ↓e = {e0 ∈ E | e0  e}. As usual, we identify each finite configuration C with the state of the system that is reached after all the events in C have occurred. A local configuration then defines a local state. The set of local configurations of a branching process β is denoted by Cloc (β). In order to simplify the handling, we introduce a virtual event symbol ⊥ that can be seen as initial event with an empty preset and Min(N ) as postset. ↓⊥ then denotes the empty configuration. We extend the set of events of Unf to E⊥ := E ∪ {⊥} and set loc(⊥) = I. In distributed systems, we define the i-view ↓i C of a configuration C as ↓i C := {e ∈ C | ∃e0 ∈ (C ∩ Ei ) : e  e0 } The i-view is a configuration: the empty configuration if C ∩ Ei = ∅, and the local configuration of the (unique) maximal i-event in C, otherwise. This follows from the sequentiality of the subsystems. Thus, ↓i C can be understood as the most recent local state of the subsystem i ∈ I that the whole system is aware of in the global state C. The i-view of the local configuration ↓e is written as ↓i e. Two nodes of an occurrence net are concurrent if they are neither in conflict nor causally related. A set B 0 of conditions of an occurrence net is called a coset if any two elements of B 0 are concurrent. A co-set is called a cut if it is a

41

maximal co-set w.r.t. set inclusion. There is a tight interrelation between finite configurations and cuts: the set of conditions Cut(C) = (Min(N ) ∪ C • ) \ • C where C is a finite configuration, is a cut. The corresponding set of places π(Cut(C)) is a reachable marking, denoted by M(C) and called final state of C. Notice that for every reachable marking M of the system there exist a (not necessarily unique) finite configuration with final state M . Configurations are called M-equivalent, denoted by C =M C 0 , if their final state is equal. Two M-equivalent configurations C, C 0 have a similar “future”, i.e., there exists an isomorphism between the part of Unf that lies behind C and that one behind C 0 . Formally, if C =M C 0 then β(C) is isomorphic to β(C 0 ), where β(C) := {x ∈ B ∪ E | ∃b ∈ Cut(C). b  x ∧ ∀y ∈ C. ¬(x#y)}. Assume two M-equivalent local configurations ↓e, ↓e0 with |↓e| < |↓e0 |. The branching process β(↓e) can be seen as β(↓e0 ) “shifted backward”. Any configuration C 0 containing e0 thus can be shifted backward to an M-equivalent configuration C containing e. 0 In [Esp94] this idea was formalized as follows: let Iee denote the isomorphism 0 from β(↓e ) to β(↓e), and C be a configuration of Unf. The (e0 , e)-shift of C, denoted shif t(e0 ,e) (C), is defined by  C if e0 ∈ /C 0 shif t(e0 ,e) (C) := e 0 0 ↓e ∪ Ie (C \ ↓e ) if e ∈ C Local S successor relation. Let Act be a distributed alphabet of actions, i.e., Act = i∈I Acti where the Acti are not necessarily disjoint. We speak of the location of an action, defined as loc(a) := {i | a ∈ Acti }. Assume a mapping l from the transitions (and, via π, also from the events) to the actions that respects the distribution of the alphabet: l(t) = a implies loc(t) = loc(a). Given two configurations C, C 0 we call C 0 an a-successor of C, written as a C −→ C 0 , if C 0 = C ] {e} for some event e mapped to the action a. This relation works fine for global configurations, but when considering local configurations it turns out to be too restrictive. Intuitively, we want to speak of the local a-successor of the local state ↓e, if for some locations that participated in e the next possible action is an a, ignoring the fact that some other locations possibly have to do some preparing steps until a is enabled. By parameterizing the successor relation with sets of locations, we will determine which of the locations may do those preparing steps, and for which locations the a is the immediate next action. Let C1 , C2 be configurations, a an action, and J a non-empty set of locations such that loc(a) ∩ J 6= ∅. We call C2 a J-local a-successor of C1 , written as a C1 −→J C2 , if there exists a configuration C10 ⊇ C1 such that ↓i C1 = ↓i C10 for a all i ∈ J, and C10 −→ C2 . If J = {i} is a singleton, we write −→i . Note that −→i captures the local transition relation in an adequate way, i.e., −→i in the unfolding of ΣI corresponds to the −→ relation in the unfolding of Σi .

42

3

The distributed µ-calculus

In this section we define the syntax and semantics of a version of the µ-calculus [Koz83] that is adequate to describe local properties of the components of a distributed system. More precisely, the formulae of the logic are interpreted over the local configurations of the unfolding of a distributed net system. The logic is adapted from a similar linear time logic for Mazurkiewicz traces [Nie95]. We will indicate how the local approach can be used for the specification and verification of distributed systems, and show that our logic naturally can be transferred to the conventional framework of global states. Syntax. Let (NI , M0 ) be a distributed net system, Unf = (N 0 , π) its unfolding, and l : T → Act a labelling of the transitions of NI with actions taken from the alphabet Act. We identify the corresponding labelling of events with l, i.e., l(e) = l(π(e)) for e in Unf. The abstract syntax of the logic is given by ϕ ::= p | ¬p | x | ϕ ∧ ϕ | ϕ ∨ ϕ | [a]J ϕ | haiJ ϕ | µx.ϕ | νx.ϕ where the atomic propositions p range over the set P of places of the distributed net, x over a set V of propositional variables, a over Act, and J over 2I \ ∅. For the modal operators [a]J and haiJ , we assume J ∩ loc(a) 6= ∅. The intended meaning of haiJ ϕ is that there exists a next local state ↓e such that l(e) = a and no event of any of the locations in J will happen before e. The operators µ and ν bind the variables. A formula that does not contain any free variable is closed. We use the basic propositions trueWand false as abbreviations for V νy.y and µy.y, respectively, and define h-iJ ϕ := a∈Act haiJ ϕ and [-]J ϕ := a∈Act [a]J ϕ. We only allow negation of atomic propositions. However, the logic is closed under negation, because every operator has its dual, and negations can be drawn inside down to the atomic propositions. Semantics. The semantics of a formula ϕ of our logic is a set of local config⊆ Cloc (Unf ), where Unf is the urations (satisfying it), and is written as [ ϕ]]Unf v unfolding under consideration and v : V → 2Cloc (Unf ) is a valuation function for the variables. Since Unf is clear from the context, we omit this superscript, and if also v is understood, we simply write [ ϕ]]. For ↓e ∈ [ ϕ]] we also write ↓e |= ϕ. We inductively define the semantics according to the following rules: [ p]]v = {↓e | p ∈ M(↓e)} [ ¬p]]v = {↓e | p 6∈ M(↓e)}

[ νx.ϕ]]v = [ µx.ϕ]]v =

S{A | A ⊆ [ ϕ]] T{A | [ ϕ]]

v[x:=A] }

v[x:=A]

⊆ A} a

0

[ ϕ ∧ ψ]]v = [ ϕ]]v ∩ [ ψ]]v

[ [a]J ϕ ] v = {↓e | ∀e ∈ E . if ↓e −→J ↓e0 then ↓e0 ∈ [ ϕ]]v }

[ ϕ ∨ ψ]]v = [ ϕ]]v ∪ [ ψ]]v

[ haiJ ϕ ] v = {↓e | ∃e0 ∈ E . ↓e −→J ↓e0 and ↓e0 ∈ [ ϕ]]v }

a

where v[y := A](y) = A, and for z 6= y we have v[y := A](z) = v(z). We say that system Σ satisfies the formula ϕ, denoted by Σ |= ϕ, if the empty configuration ↓⊥ belongs to [ ϕ]].

43

Note that a local state ↓e may satisfy an atomic proposition p that does not belong to the location of e. Thus, the proposed logic allows to express properties corresponding to the local view that one component has onto other components. We briefly comment on the assertions expressible by the proposed language. Single-located formulae are simply formulae of the standard µ-calculus, interpreted on the corresponding subsystem. For instance, Ψ = νx.ϕ ∧ [-]i x means that on every path of the i-component ϕ holds at every local state – ‘ϕ always holds in i’. If we substitute [-]i x by ([-]i x ∧ h-ii true) in Ψ , we additionally express that the mentioned path is of infinite length since for every local state of i there must exist a successor. ‘ϕ holds in i infinitely often’ can be formalized as νy.µx.(ϕ ∨ [-]i x) ∧ [-]i y ∧ h-ii true. Notice, however, that this formula may hold even if there exist global runs in which the i-component only executes a finite number of events. It actually states that if i executes infinitely many events in the future then it will satisfy ϕ infinitely often. It is useful to translate a local logic reminding of CTL [CES86] to our logic. Localised variants of the two next operators, EXJ and AXJ are already part of the syntax, namely h-iJ and [-]J . The set of locations specifies, for which components this event is a next step. Similarly we now define the until-operators of CTL with locations: E(ϕUJ ψ) := µy.ψ ∨ (ϕ ∧ h-iJ y) A(ϕUJ ψ) := µy.ψ ∨ (ϕ ∧ [-]J y ∧ h-iJ true).

Other CTL-like operators, such as AGJ , AFJ , EGJ , EFJ can in turn be defined using the until-operators in the standard way. E(ϕUJ ψ) specifies a J-local chain of events along which ϕ holds until ψ is satisfied. The more interesting properties, of course, are expressed by formulae referring to distinct subsystems. If J = {i, j, k} then νy.[-]i y ∧ (p → haiJ true) describes that whenever p holds in i then i’s next a-action may be a synchronization with j and k, which is also for j and k the next step. Another example referring to several components can be found in the appendix. It is also W possible to refer to conflicts in the causal future of local configurations: i∈I (h-ii p ∧ h-ii ¬p) states that there are two next events in conflict which can be distinguished by p. Nevertheless, it is not possible to express that there are two identically labelled, but conflicting events if their future cannot be distinguished with the distributed µ-calculus. As a further example we specify properties of the echo-algorithm as defined in [Wal95] in the distributed µ-calculus. Assume a (strongly connected) network consisting of a set of agents Ag including initiator A0 . Each agent Ai communicates exclusively with her direct neighbours, and each agent (but the initiator) behaves identically. At any time the initiator wants to flood the whole network with a wake-up signal, each agent – after receiving a wake-up – executes a local computation and sends back an accept signal afterwards. Whenever the initiator reaches state terminated, she wants to be sure that every agent V in the network has executed her local computation: Σ |= AG0 (terminated → i≥1 acceptedi ). Furthermore, no agent shall have finished her local computation, when any V V of her neighbours is still sleeping: Σ |= i≥1 AGi (acceptedi → j∈Ni ¬sleepingj ).

44

4

Transition systems semantics

Now we want to show that the unfolding can be understood as a local transition system TUnf with transitions labelled by indexed actions aJ , J ⊆ I, and with the local configurations of Unf as set of states. It will be immediate that on TUnf the distributed µ-calculus corresponds to the standard µ-calculus over the g = {aJ | a ∈ Act, J ⊆ I}. modified action alphabet Act µ-calculus and bisimulation. The syntax of the µ-calculus [Koz83] is given by ϕ ::= p | ¬p | x | ϕ ∧ ϕ | ϕ ∨ ϕ | haiϕ | [a]ϕ | µx.ϕ | νx.ϕ where p ∈ P , x ∈ V, and a ∈ ActT . The semantics of the µ-calculus is defined over transition systems T = hS, s0 , →, ActT , P, Ii where S is a set of states, ActT an action alphabet, s0 ∈ S the initial state, → ⊆ S ×ActT ×S the transition relation, and I : S → 2P an interpretation mapping the states onto the propositions. a As usual, we write s −→ s0 if (s, a, s0 ) ∈ →. The semantics of a µ-calculus formula ϕ over a given transition system T is denoted by [ ϕ]]Tv ⊆ S, where v is the valuation function for the variables. We write s |=T ϕ if s ∈ [ ϕ]]v . The semantics is defined inductively by: [ p]]v [ ¬p]]v [ ϕ ∧ χ]]v [ ϕ ∨ χ]]v

= = = =

{s | p ∈ I(s)} {s | p ∈ / I(s)} [ ϕ]]v ∩ [ χ]]v [ ϕ]]v ∪ [ χ]]v

[ νx.ϕ]]v [ µx.ϕ]]v [ haiϕ]]v [ [a]ϕ]]v

S T

= {A = {A = {s | = {s |

| A ⊆ [ ϕ]]v[x:=A] } | [ ϕ]]v[x:=A] ⊆ A} a ∃s0 ∈ S . s −→ s0 and s0 ∈ [ ϕ]]v } a 0 ∀s ∈ S . if s −→ s0 then s0 ∈ [ ϕ]]v }

It is well-known that the distinguishing power of the µ-calculus is limited to standard bisimulation: A relation R ⊆ S × S is called a bisimulation iff for any s R s0 it holds that I(s) = I(s0 ) and for all a ∈ ActT a

a

– if s −→ s1 , then there exists s01 with s0 −→ s01 and s1 R s01 , and dually a a – if s0 −→ s01 , then there exists s1 with s −→ s1 and s1 R s01 . Two states s and s0 are called bisimilar, denoted s ∼ s0 , iff there exists a bisimulation R with s R s0 . We also write T ∼ T 0 if for the initial states s0 ∼ s00 . It was shown by Milner [Mil89] (see also [Sti92]) that s ∼ s0 implies s |=T ϕ ⇔ s0 |=T ϕ for all closed µ-calculus formulae ϕ. The local transition system TUnf . Let Unf be the unfolding of a distributed net system Σ. Then the local transition system extracted from Unf is given aJ a 0 g P, Ii where ↓e −→↓e iff ↓e −→J ↓e0 , and the by TUnf = hCloc (Unf ), ↓⊥, →, Act, interpretation of propositions I(↓e) = M(↓e) for all ↓e. Two events e1 , e2 are M-loc-equivalent iff ↓e1 =M ↓e2 and loc(e1 ) = loc(e2 ). Proposition 1. Let ↓e1 , ↓e2 ∈ TUnf . If e1 and e2 are M-loc-equivalent then ↓e1 ∼ ↓e2 . Proof. Let I be the isomorphism from β(↓e1 ) to β(↓e2 ), induced by M-equivalence of ↓e1 and ↓e2 . Clearly, loc(f ) = loc(I(f )), and f  g iff I(f )  I(g) for all

45

events f, g ∈ β(↓e1 ). If furtheron e1 ≺ f and e2 ≺ I(f ), the events f and I(f ) again are M-equivalent, and thus =M would be a bisimulation. However, it does not necessarily hold that e1 ≺ f iff e2 ≺ I(f ). The additional loc-condition now preserves the desired causality: Let us call e0 a direct successor of e, iff e• ∩ • e0 6= ∅. For all e1 , e01 it holds that if e01 is a direct successor of e1 then loc(e1 ) ∩ loc(e01 ) 6= ∅. Consequently, if e01 is a direct successor of e1 then I(e01 ) ∈ β(↓e2 ) is a direct successor of e2 iff loc(e2 ) ∩ loc(I(e01 )) 6= ∅. Thus the set of direct successors is preserved under M-loc-equivalence. Since every J-local successor of an event e1 is a direct successor of e1 or the J-local successor of a direct successor of e1 , and since every direct successor of e1 is M-loc-equivalent to the corresponding direct successor of e2 , indeed M-locequivalence is a bisimulation. 2 Let ϕ be a formula of the distributed µ-calculus. Then ϕ˜ denotes the formula where each occurrence of haiJ is substituted by haJ i, and similarly [a]J by [aJ ]. Proposition 2. ↓e |= ϕ iff ↓e |=T ϕ˜ for any ↓e ∈ Cloc (Unf ).

5

Model checking

In this section we develop the technical tools required to achieve efficient verification techniques for the logic. In fact we will not give an algorithm for the model checking procedure itself. Rather we give a construction, which reduces the model checking problem for the distributed µ-calculus to a suitable input for well understood algorithms known from sequential model checking like [CES86,CS93]. As a first step, we will show that there exists a finite transition system TFin bisimilar to the usually infinite system TUnf . This finite system TFin can be defined over the set of local configurations of the complete finite prefix introduced by McMillan [McM92]. Secondly, we give an algorithm for constructing TFin . The finite prefix. In [McM92], McMillan showed how to construct a finite prefix of the unfolding of a finite-state net system in which every reachable marking is represented by some cut. We will use a slight modification of this prefix to obtain a finite transition system with local states, bisimilar to TUnf . Let Unf = (N 0 , π) be the unfolding of a net system. A cut-off event is an event e ∈ E⊥ whose local configuration’s final state coincides with the final state of a smaller local configuration with the same location, formally: ∃ e0 ∈ E⊥ : |↓e0 | < |↓e| and e, e0 are M-loc-equivalent. In McMillan’s standard definition M-equivalence suffices.5 Notice that in general for each cut-off event e there may be several corresponding M-loc-equivalent 5

The cut-off events from the unfolding of the distributed net system of Fig. 1 are tagged by “◦” in Fig. 2 whereas the cut-offs due to McMillan’s original definition are tagged by “∗”.

46

events e0 . In the sequel, we fix one of them and refer to it as corr (e). The prefix Fin is then defined as the unique prefix of Unf with EFin ⊆ E⊥ as set of events, where EFin is characterised by e ∈ EFin

iff

no event e0 ≺ e is a cut-off event.

It is easy to prove that Fin is finite for net systems with finitely many reachable markings. Usually, the prefix Fin is much smaller than the state space of the system. However, it can also be larger. In [ERV96] it is shown how to improve McMillan’s construction such that the finite prefix never exceeds the size of the full state space (up to a constant). The main idea is to determine cut-off events not by comparing the size of the local configurations of events (which does not produce any cut-off event when the sizes are equal), but other well-founded partial orders instead. In the prefix generated by the refined algorithm, if e and e0 are two different non-cut-off events, then they are not M-loc-equivalent. The number of location sets occurring at events can grossly be bounded by the number of transitions in the original net. Therefore, the number of non-cutoff events never exceeds the number of reachable states times the number of transitions of the original net, and so the prefix can never be substantially larger than the state space. The finite, local transition system TFin . Now we show that there exists a finite transition system TFin ∼ TUnf , such that the states of TFin are at most the local configurations of the finite prefix. Observe that the modified McMillan construction in fact guarantees that for each local configuration ↓e in Unf there exists an M-loc-equivalent corresponding configuration ↓e0 in Fin, i.e., ↓e ∼ ↓e0 in TUnf , and e0 ∈ EFin . The only reason for e ∈ / EFin can be that e supersedes a cut-off belonging to Fin and therefore itself is a cut-off. By induction it is possible to find a corresponding event for e within EFin . For the following, we select for each equivalence class of bisimilar configurations ↓e in Unf a unique representative ↓corr(e) in Fin which is minimal w.r.t. the size of |↓corr (e)|. (In case of using the improved prefix [ERV96], corr (e) is selected from the non-cut-off events in EFin and thus uniquely determined.) If we have two bisimilar states ↓e1 ∼ ↓e2 in TUnf we can replace each tranaJ aJ ↓e1 by ↓e −→ ↓e2 for any source state ↓e and obtain a transition sition ↓e −→ 0 bisimilar with TUnf on all states and with the same state space. system TUnf Since we have selected for all local configurations ↓e, ↓e0 bisimilar representatives ↓corr(e) and ↓corr(e0 ) in Fin, we can (imaginarily) “bend” all the aJ aJ ↓e0 in TUnf to transitions ↓corr (e) −→ ↓corr (e0 ) in Fin (postransitions ↓e −→ sibly merging infinitely many transitions into one). Since corr (e) is unique and minimal, afterwards all local states ↓e reachable from ↓⊥ via transitions are noncut-offs. Now we discard all cut-off events (whether contained in Fin or not). We call the resulting transition system TFin . Observe that TFin is even smaller than Fin itself, since cut-offs are discarded. We obtain: Proposition 3. TFin ∼ TUnf .

47

Theorem 1. For any closed formula ϕ of the distributed µ-calculus it holds that ˜ ↓⊥ |= ϕ iff ↓⊥ |=TFin ϕ. Theorem 1 is an immediate consequence of Proposition 2 and Proposition 3. Thus we can reduce the model checking problem of the distributed µ-calculus for some e1 c2 distributed net system to the model-checking d2 e{1,2} problem of the standard µ-calculus over TF in . a{1,2} a2 Observe that TFin is not bigger than the global a {1,2} c2 state space (i.e. the product of the local state a2 c2 d2 d 2 spaces) times the number of transitions of a1 b1 a{1,2} the distributed net system – and often much ⊥ smaller. The figure depicts TFin of the prefix drawn in Fig. 2. An algorithm to compute TFin . By now we know that TFin exists, the question remains, how we can compute it. We propose an algorithm that takes Fin as input and moreover uses the structural information, which the algorithm computing Fin has built up: – a function corr mapping all M-loc-equivalent events onto a unique representative non-cut-off event. The codomain of corr is called ERep ⊂ EFin , the set of representative events. The state space of TFin is formed by the local configurations of these representatives. – a function shift∗ , which maps any configuration C = C1 of Unf containing some cut-off to a configuration shift∗ (C) = C 0 = Cn not containing a cut-off, hence being present in Fin. This function works by repeatedly applying Ci+1 := shif t(ei ,corr(ei )) (Ci ) with ei being a cut-off in Fin contained in Ci . shift∗ terminates, because the sequence C1 , C2 , .. decreases in the underlying (well-founded) order (e.g. contains less and less events in the case of the McMillan order). Obviously this function implies the existence of an isomorphism I between β(C) and β(shif t∗ (C)), which is the composition of ei the isomorphisms Icorr(e induced by the chosen cut-off events. Moreover, i) ∗ shift (↓e) is strictly smaller than ↓e (in the underlying order) for any a e ∈ β(C), and hence for any e, for which C −→J ↓e.

The most important part of the algorithm is the recursive procedure successors which, when called from the top level with a triple (↓e, J, a), returns the aJ -successors for ↓e in TFin . More generally, successors performs depth-first search through triples (C, J, a), where C is an arbitrary, not necessarily local configuration not containing a cut-off, J is a non-empty subset of locations, and a is an action. It determines the subset of events in ERep that represent the J-local a-successors of C. Formally, e ∈ successors(C, J, a) iff there exists ↓e0 in a Unf, which is M-loc-equivalent to ↓e, and C −→J ↓e0 . The procedure works as a 0 follows. Assume there exists at least one e anywhere in Unf with C −→J ↓e0 ; then there are two possibilities: (1) One of these e0 lies in the prefix. This is easy to determine. The corresponding event corr(e0 ) ∈ ERep is given back by prefix successors(C, J, a).

48

type Vertex = { C: Configuration; J: LocationSet; a: ActionLabel; pathmark: bool ; (* for depth first search *) } a

prefix successors(C, J, a) = {↓corr(e) | e ∈ EFin ∧ C −→J ↓e} inheritable extension(C, e, J, a) = (∀i ∈ J. (↓e \ C) ∩ Ei = ∅) (* predicate ensuring, that joining ↓e to C adds no i-events for i ∈ J *) compatible cutoffs(C) = {e | e is cut-off and ↓e ∪ C is a configuration in Fin} proc successors(C, J, a): ConfigurationSet; { var result: ConfigurationSet; (* result accumulator for the current vertex *) Vertex v := findvertex(C,J,a); (* lookup in hash table, if not found then *) (* create new vertex with pathmark = false *) if v.pathmark then return ∅; fi (* we have closed a cycle *) result := prefix successors(C, J, a); (* directly accessible successors *) v.pathmark:=true; (* put vertex on path *) for ec ∈ compatible cutoffs(C) do (* find successors outside the prefix behind ec *) if inheritable extension(C, ec , J, a) then result := result ∪ successors(shift∗ (C ∪ ↓ec ), J, a); fi od ; v.pathmark:=false; (* take vertex from path *) return result; } proc ComputeTFin ; { InitializeTransitionSystem(ts,Fin) (* extract state space from F in *) for e ∈ ERep , a ∈ Act, ∅ = 6 J ⊆ I do for ↓e0 ∈ successors(↓e,J,a) do aJ 0 add transition ↓e −→↓e od od }

Fig. 3. The conceptual algorithm to compute TFin

49

(2) There exist such events e0 , but none of them lies in the prefix. The reason / EFin is the existence of a cut-off ec ∈ EFin , such that ec  e0 . So we can for e0 ∈ do a case analysis over the compatible cut-offs. A cut-off ec is compatible with C if it is not in conflict with C, i.e., ↓ec ∪ C is a configuration in Fin. If there is a compatible ec , such that (↓ec \ C) ∩ Ei = ∅ for all i ∈ J then for at least a one of them, we have (C ∪ ↓ec ) −→J ↓e0 . In this case we inherit the transition a C −→J ↓e0 . In the second case, we loop over all compatible cut-offs ec looking at the configuration Cc := C ∪ ↓ec . If the J-local a-successors of Cc are J-local asuccessors of C (determined by inheritable extension(C, ec , J, a)) we want to search for the successors(Cc , J, a). But if any J-local a-successor e0 of Cc exists, then there also exists a bisimilar e00 for C ∗ := shif t∗ (Cc ) (by the isomorphism), where moreover ↓e00 is smaller than ↓e0 . So successors is recursively called with (C ∗ , J, a). Note that C ∗ contains no cut-off. Hence we apply depth-first search with respect to triples (C, J, a). Cycles may occur (if we hit a triple (C, J, a) with pathmark= true), at which we break off to ensure termination. Note that the search space is limited by the fact that C is represented in Fin and does not contain cut-offs. It remains to show that the termination is correct: Assume a J-local asuccessor e0 of C exists. Then we choose from all these suitable successors a minimal one named emin . Whenever a configuration (C ∪ ↓ec ) is shifted with shif t∗ to obtain a configuration C 0 for the next call of successors, also emin is shifted to a strictly smaller e0min . Thus in case we hit a configuration C twice, when searching for J-local a-successors, emin is mapped by the various shif t∗ s to a strictly smaller event e∗min which contradicts the minimality of emin . Thus whenever a configuration is investigated a second time for J-local a-successors, we know that there cannot be one. The main procedure ComputeTFin thus only has to loop about all possible aJ 0 in TFin and to triples (↓e, J, a) with e ∈ ERep to check for transitions ↓e −→↓e insert the results of successors. Concluding the above discussion, we obtain: Theorem 2. The algorithm ComputeTFin computes TFin . Note that at top level, successors is only called with local configurations C, but the extension of C with cut-offs requires that we can also handle some global configurations. Further note that we present the algorithm in Fig. 3 with emphasis on understandability, not efficiency: many vertices (C, J, a) will be explored very often, leading to an unsatisfying runtime. However it is very easy to modify the algorithm so that every vertex is explored at most once, essentially by storing intermediate results with the vertices in the hash-table. Then the runtime of the algorithm is proportional to the size of the search space. Since we have to deal with some global configurations, in principle the search space can grow to the size of the global state space times the number of the transitions of the original net, but no larger. Experiments suggest that in many cases the number of visited global states will remain small compared to the number of all global states existing.

50

Heuristic improvements. Apart of the improvements mentioned above, the algorithm also allows for several heuristic improvements to save unnecessary computation. For instance, it is impossible that a state ↓e has any aJ -successor if the J-places in M(↓e) are not contained in • t for any a-labelled transition t of the original net, and thus successors(↓e, J, a) need not to be called. Moreover, the algorithm can be combined with on-the-fly algorithms (sometimes called local model checking), by only calling successors, when the model checker needs to find the aJ -successors of some state.

6

Conclusion

We introduced a distributed version of the µ-calculus and showed its use in describing branching time properties of distributed algorithms based on local states. We reduced the model checking problem for the distributed µ-calculus to the well-investigated model checking problem of sequential logics over transition systems. How expensive is all this? The computation of TFin can be as costly as generating the global state space (although often it will be much cheaper), the resulting system TFin is typically much smaller than the global transition system. The transformation of the formulae is for free. So the cost of computing TFin does not affect the runtime of the standard model checker in the next phase. It is necessary to investigate really meaningful examples, to give a concise answer on the benefits of the proposed approach. First experiments with a prototype implementation indicate that TFin and the number of global states visited during its computation indeed are very small. Independently, Penczek [Pen97] suggested a model checker for a future fragment of his event structure logic DESL. Instead of using net unfoldings, Penczek relies on partial order methods in the generation of a finite representation of the event structure. The causal future operators of DESL as considered in [Pen97] can easily be treated by the algorithm we proposed here by changing the modalities and the successor relation accordingly. At the price of the restriction to free-choice systems, in [Pen97] also an immediate conflict operator is handled. Acknowledgment. We thank P.S. Thiagarajan for discussions on location based logics. Burkhard Graves has helped our understanding of the subtleties of Fin. Special thanks to Javier Esparza, whose contribution to this work in its initial phase was very important.

References CES86.

CS93.

Eng91.

E.M. Clarke, E.A. Emerson, and A.P. Sistla, Automatic verification of finitestate concurrent systems using temporal logic specifications, ACM Transactions on Programming Languages and Systems 8 (1986), no. 2, 244–263. Rance Cleaveland and Bernhard Steffen, A linear time model-checking algorithm for the alternation-free modal mu-calculus, Formal Methods in system Design 2 (1993), 121– 147. J. Engelfriet, Branching processes of Petri nets, Acta Informatica 28 (1991), 575–591.

51 J. Esparza, S. R¨ omer, and W. Vogler, An Improvement of McMillan’s Unfolding Algorithm, Tools and Algorithms for the Construction and Analysis of Systems TACAS ’96 (Passau, Germany) (T. Margaria and B. Steffen, eds.), LNCS, vol. 1055, Springer, 1996, pp. 87–106. Esp94. J. Esparza, Model checking using net unfoldings, Science of Computer Programming 23 (1994), 151–195. GW91. P. Godefroid and P. Wolper, A Partial Approach to Model Checking, Proceedings of the 6th IEEE Symposium on Logic in Computer Science (Amsterdam), July 1991, pp. 406–415. HNW96. M. Huhn, P. Niebert, and F. Wallner, Put your model checker on diet: verification on local states, Technical Report TUM-I9642, Technische Universit¨ at M¨ unchen, December 1996. Koz83. Dexter Kozen, Results on the propositional µ-calculus, TCS 27 (1983), 333– 354. LRT92. K. Lodaya, R. Ramanujam, and P.S. Thiagarajan, Temporal logics for communicating sequential agents: I, Int. Journal of Foundations of Computer Science 3 (1992), no. 2, 117–159. LT87. K. Lodaya and P.S. Thiagarajan, A modal logic for a subclass of event structures, Automata, Languages and Programming (T. Ottmann, ed.), LNCS, vol. 267, Springer, 1987, pp. 290–303. McM92. K.L. McMillan, Using unfoldings to avoid the state explosion problem in the verification of asynchronous circuits, Proceedings of the 4th Workshop on Computer Aided Verification (Montreal), 1992, pp. 164–174. Mil89. R. Milner, Communication and concurrency, Prentice Hall, 1989. MT89. M. Mukund and P.S. Thiagarajan, An axiomatization of event structures, Foundations of Software Technology and Theoretical Computer Science (C.E. Veni Madhavan, ed.), LNCS, vol. 405, Springer, 1989, pp. 143–160. Nie95. Peter Niebert, A ν-calculus with local views for systems of sequential agents, MFCS, LNCS, vol. 969, 1995. NPW80. M. Nielsen, G. Plotkin, and G. Winskel, Petri nets, event structures and domains, Theoretical Computer Science 13 (1980), no. 1, 85–108. Pel93. Doron Peled, All from one, one for all: on model checking using representatives, Computer Aided Verification CAV, LNCS, 1993. Pen97. W. Penczek, Model-checking for a subclass of event structures, TACAS, 97, to appear. Rei85. W. Reisig, Petri Nets, EATCS Monographs on Theoretical Computer Science, vol. 4, Springer, 1985. Sti92. Colin Stirling, Modal and temporal logics, Handbook of Logic in Computer Science (S. Abramsky, D. Gabbay, and T. Maibaum, eds.), Oxford University Press, 1992. Thi94. P.S. Thiagarajan, A Trace Based Extension of PTL, Proceedings of the 9th IEEE Symposium on Logic in Computer Science, 1994. Thi95. P.S. Thiagarajan, A Trace Consistent Subset of PTL, Proceedings of CONCUR ’95 (Philadelphia, P.A., USA) (I. Lee and S.A. Smolka, eds.), LNCS, vol. 962, Springer, 1995, pp. 438–452. Val91. A. Valmari, Stubborn Sets for Reduced State Space Generation, Advances in Petri Nets 1990 (G.Rozenberg, ed.), LNCS, vol. 483, 1991, pp. 491–515. Wal95. Rolf Walter, Petrinetzmodelle verteilter Algorithmen – Beweistechnik und Intuition, Ph.D. thesis, Humboldt-Universit¨ at zu Berlin, Institut f¨ ur Informatik, 1995, edition VERSAL, W. Reisig (Hrsg.), Dieter Bertz Verlag. ERV96.

Exploiting Symmetry In Linear Time Temporal Logic Model Checking: One Step Beyond K. Ajami* * LIP6 - CNRS ERS 587 Univ. Pierre & Marie Curie, Tour 65-66, Bureau 204, 4, place Jussieu, 75252 Paris Cedex 05 e.mail: [email protected], [email protected]

S. Haddad**

J-M. Ilié*

** LAMSADE - CNRS URA 825 Univ. Paris Dauphine Pl. du Maréchal De Lattre de Tassigny, 75775 Paris e.mail: [email protected]

Abstract. Model checking is a useful technique to verify properties of dynamic systems but it has to cope with the state explosion problem. By simultaneous exploitation of symmetries of both the system and the property, the model checking can be performed on a reduced quotient structure [2,6,7]. In these techniques a property is specified within a temporal logic formula (CTL*) and the symmetries of the formula are obtained by a syntactical checking. We show here that these approaches fail to capture symmetries in the LTL path subformulas. Thus we propose a more accurate method based on local symmetries of the associated Büchi automaton. We define an appropriate quotient structure for the synchronized product of the Büchi automaton and the global state transition graph. We prove that model checking can be performed over this quotient structure leading to efficient algorithms. Topic: Formal Methods. Keywords: Temporal Logic, LTL, Symmetries, Büchi automata, Model Checking, Verification.

1. Introduction Checking system correctness can be performed by the specification and the verification of temporal logic formulas over a state transition graph which models the system behavior. The well-known combinatorial explosion problem in space and time requires the development of efficient techniques in order to reduce the size of the graph to be built, with respect to some desired properties. One of the most promising technique has been initiated by Emerson & al [6,7]. It exploits the symmetries of both the system and formula. Such a technique builds a quotient graph in which each node represents an equivalent class of states. The relation is induced by a subgroup of permutations preserving the state graph and the formula. In practice, the permutations act on a set of system processes with identical behavior. Previous works have been already developed focusing on the safeness properties [1,14,17,19]. Other developments include model checking algorithms [2,13], model checking under fairness constraints [8] and application to system bisimulation [16]. Looking carefully at the technique described in [6,7], it appears that currently, the

CTL* model checking can make profit from the symmetries but in a restrictive way. Roughly speaking, two kinds of symmetries are detected: propositional symmetries (e.g. contain subformulas like f = Vi ∈ I fi where fi is a propositional formula involving the process i) and global symmetries with respect to a group of symmetries acting on the structure representing the formula (Büchi automata for linear temporal formulas like f = Vi ∈ I Ffi ). The aim of this paper is to generalize the previous methods showing how local symmetries can be exploited inside path subformulas of a CTL* formula. In this work, we limit the presentation to the case of LTL formulas. The general framework for branching time model checking can be developed using the iterated method of [10]. Unlike the approach presented in [6,7], the considered Büchi automaton is not necessarily globally symmetric with respect to a predefined symmetry group. The starting point of our method is the analysis of any Büchi automaton associated with a LTL formula to be verified (see for instance [11]). Then we relate two states of the Büchi automaton if they represent the same current and future behavior up to a permutation of processes. Given a permutation, this state relation can be computed in polynomial time. Similarly, in the system model, two states are related by a permutation with respect to their current value of the system variables. By applying these relations on the synchronized product of the Büchi automaton and the global state transition graph, we define an appropriate quotient structure. Then we prove that model checking over this quotient is equivalent to model checking over the synchronized product. However, the general computation of permutations wipes out the benefit of having a quotient structure (exponential complexity of computation). Therefore, we propose an alternative approach which computes, in polynomial time, an intermediate size structure. Such a structure has the same equivalence property as the quotient one and leads, in practical cases, to significant savings of space (even exponential). The next sections are organized as follows: part 2 presents the model of computation and briefly recalls the temporal logic used to specify properties, it also presents the representation of a linear temporal logic formula by means of a Büchi automaton; part 3 presents the definition of system symmetries while part 4 presents the symmetries reflected in a temporal logic formula; part 5 is the analysis of the model checking using symmetries and the proof of its validity; part 6 contains the operational model checking approach using symmetries; part 7 contains our conclusion and perspectives.

2. Model of Computation and Temporal Logic We can apply our work on any system where symmetries are defined within a group of permutations. So, let us consider a simple model of system. 2.1. The Model We deal with finite state concurrent systems composed of many processes. Processes are identified by indices. They may share global variables but differ from local ones. The structure of such a system is defined as follows: Definition 2.1.1: Finite State Concurrent System We present a finite state system using the temporal structure M=(S, ∆, I, V, D, L, S0) where: - S is the finite set of the states; S0 ⊆ S is the set of initial states;

- ∆ ⊆ S × S is the possible changes between states; - I is the set of process indices; - V is the set of system variables; it is composed of two distinct subsets, VG, the set of global variables and VL the set of local variables. - D is the definition domain of variables. - L is the state labeling function, L: S × ( VG ∪ VL × I) → D such that: (i) L(s,vg) is the value of variable vg of VG in state s; (ii) L(s,vl,i) is the value of variable vl of VL of process i in state s. Atomic propositions are built from the association of a value to a variable. Remark: The structure of a system depends only on the value of the variables i.e. two different states must have at least one variable with different values. Definition 2.1.2: Global and Local Atomic propositions A global atomic proposition, is a pair ( vg, d) ∈ VG × D whereas a local atomic proposition is a triplet ( vl, i, d) ∈ VL × I × D that depends on a process i. We define AP= { p p ∈ VG × D ∪ VL × I × D} the set of atomic propositions built on the global and local variables. We define prop: S → 2

AP

such that prop(s) is the set of propositions associated with s.

Definition 2.1.3: Atomic propositions holding in a state Global (respectively local) atomic propositions hold at state s of S (noted |=) as follows: s |= ( vg, d) ⇔ L ( s, vg) = d ; (respectively s |= ( vl, i, d) ⇔ L ( s, vl, i) = d ). In the following we recall some notions of temporal logic used to specify system properties.The translation of linear temporal formulas to Büchi automata is also presented. 2.2. Temporal Logic In a propositional Temporal Logic, the non temporal portion of the logic is propositional logic. Thus formulas are built up from atomic propositions, which intuitively express, atomic facts about the underlying state of the concurrent system, truth-functional connectives and the temporal operators. Furthermore, when defining a system of temporal logic, two possible views of the system, can be considered, regarding the nature of time. One is that the course of time is linear: at each moment there is only one possible future moment. The other is that time has a branching tree-like nature: at each moment, time may split into alternate courses representing different possible futures. In linear time, one reasons about sets of infinite sequences, while in branching time, one reasons about the possible futures of the current state leading to branching tree like structure. In our work we are mainly interested by the linear time temporal logic formulas. However, the notion of branching time temporal remains the general framework in which our model checking can be extended. We use here two kinds of operators, temporal operators presented later and path quantifiers using the two symbols, A, E, to indicate respectively all or some paths.

2.2.1. Linear Temporal Logic (LTL) A well-formed linear-time temporal logic, dealing with our system, is constructed from the set of atomic propositions AP, the standard boolean operators V (Or), ¬ (Not), and the temporal operators X (neXttime) and U (strong Until). Precisely, formulas are defined inductively as follows: (1) Every member of AP is a formula; (2) if ϕ and ψ are formulas then so are ¬ϕ, ϕ ∨ ψ , Xϕ, ϕ U ψ. An interpretation for a linear-time temporal logic formula is an infinite word ξ=x0x1... over an alphabet 2AP. For more precision, the elements of 2AP are interpreted as assigning truth values to the elements of AP: elements in the set are assigned true, elements not in the set are assigned false. We note ξi the suffix of ξ starting at xi. The semantics of LTL is defined in the following: - ξ |= α iff α ∈ x0 , for α ∈ AP . - ξ |= ¬ϕ iff ¬(ξ |= ϕ). - ξ |= ϕ ∨ ψ iff (ξ |= ϕ or ξ |= ψ). - ξ |= Xϕ iff ξ1 |= ϕ. - ξ |= ϕ U ψ iff ∃i ≥ 0 such that ξi |= ψ and ξj |= ϕ 0 ≤ ∀j < i . As some abbreviations, one can introduce additional linear operators: the eventuality operator F where Fϕ= true U ϕ, the always operator G where Gϕ=¬F¬ϕ. 2.2.2. From LTL to Büchi automata A Büchi automaton is a finite automaton which accepts infinite sequences. A sequence is accepted if, and only if, it is recognized by the automaton and meets infinitely often one of the accepting states (called also designated states). It has been shown that any LTL formula can be translated to a Büchi automaton in order to perform efficient model checking. Indeed, Büchi automata are strictly more expressive than LTL formulas and equivalent to linear-time Mu-calculus [5,18,21]. Definition 2.2.3: Büchi automata A Büchi automaton [6] is a tuple A=(AP, B, ρ, B0, E, F) where: - B is a set of states. Each state b of B is defined by the set Atom ( b) ⊆ AP . B

- ρ: B → 2 is a nondetermistic transition function. - B0 ⊆ B is a set of starting states. AP

- E: B → 2 . - F ⊆ B is a set of accepting states.

3. Symmetries on Models Given a permutation π: I → I on the set of process indices, we want to determine whether two states of the state transition graph are symmetric up to this permutation. Effectively, a permutation is said to be a symmetry if and only if it preserves the possible changes between states. We define the symmetries on the model represented by the structure M=(S, ∆, I, V, D, L, S0). Definition 3.1: Symmetry on a State Transition Graph A permutation π on I, is a symmetry iff:

(1) For each state s ∈ S , there is a unique state s′ denoted π(s) which satisfies: (i) ∀vg ∈ VG, L ( π ( s) , vg) = L ( s, vg); (ii) ∀i ∈ I, ∀vl ∈ VL, L ( π ( s) , vl, i) = L ( s, vl, π ( i) ) . (2) Permutation π satisfies the following condition: ( ∀s1 ∈ S) , ( ∀s2 ∈ S) , ( ( s1 → s2) ∈ ∆ ⇔ ( π ( s1) → π ( s2) ) ∈ ∆ ). The group of symmetries defined on M is called the automorphisms group of M and denoted Aut(M).

4. Symmetries on Formulas In [7], the symmetries of a temporal logic formula to be verified are obtained by a syntactical checking while in [6], they result from the analysis of the corresponding Büchi automaton. By looking carefully at this method, it appears that symmetries of a CTL* formula are obtained in a restrictive way. Roughly speaking, many techniques are proposed based on the detection of a group of symmetries: (1) State symmetries obtained from (sub)formulas like Vi ∈ I fi where fi is propositional involving process i. Effectively, the symmetries resulting from formulas like f= EF ( Vi ∈ I fi) , f = EF ( Λi ∈ I fi) constitute the group Sym(I), the group of all the permutations between the elements of I. Those computed for formula like f = EFfi constitute the group Stab(i) (the group of all the permutation between the elements of I \ {i}). (2) The former approach fails to capture Path symmetries in LTL subformulas like f = Vi ∈ IFfi , f = Λi ∈ IFfi . Thus, the method of [6] introduces a complementary framework by detecting a group of symmetries acting on the states of Büchi automaton. i<j

All these approaches are inefficient for formulas like f = Λi, j ∈ I ( fi U fj) because the group of symmetries is reduced to the identity. However, the former formula contains local symmetries that can be reflected in some states of its büchi automaton. In this section, we propose a more accurate method based on the exploitation of local symmetries computed for some states of the automaton. Hence, we show that the existence of a group is not required to exploit symmetries. We compute, the symmetries on a Büchi automaton, A=(AP, B, ρ, B0, E, F). The states equivalence can be detected using the relation defined as follows: Definition 4.1: Permutation on a set of atomic propositions Let π be a permutation on I. Let AP1 be a set of atomic propositions, there is a set AP2 denoted π(AP1) which satisfies: π(AP1)=AP2={ ( vg, d′) ∀ ( vg, d) ∈ Atom(b), ∃ ( vg, d′) ∈ Atom ( b′) where ( d′ = d)}∪ {( vl, j, d′) ∀i ∈ I, ∀( vl, i, d) ∈ Atom ( b) , ∃j ∈ I, ∃ ( vl, j, d′) ∈ Atom ( b′) where ( d′ = d)} Definition 4.2: Equivalence of two states of a Büchi automaton A relation Rπ is the coarsest relation that defines the equivalence of two states of a Büchi automaton. It fulfills the following two requirements: ∀b, b′ ∈ V, bRπb′ iff:

(1) There is a permutation π that satisfies the two conditions: (i) b ∈ F ⇔ b′ ∈ F ; (ii) Atom( b′ )=π(Atom(b)). (2) ∀b1 [ b → b1] , ∃b′1 [ b′ → b′1] ( b1Rπb′1). Generally, Rπ is not an equivalence relation. It can be computed in a polynomial time using a fixed-point computation starting with condition (1) and by applying (2). Example 1: Let us consider the following Büchi automaton representing the formula f = [ ( p1Up3) ∨ ( p2Up3) ] ∧ ( p1Up2) for a system of three processes P1, P2, P3, where p1, p2, p3 are three atomic propositions. b2 p1p3

b1 p1p2 b6

p1

b10

p1 p2

b7

p1 b8 p2p3

b9

b5

p1p2

b3 p2 Entry State Final State

p3 b4

Figure 1: Büchi automaton of the formula f In this automaton, the only global symmetry group acting on the states is the identity. However, one can observe that states b7 and b10 are symmetrical with respect to definition 4.1 (permutation π such that π(1)=1, π(2)=3, π(3)=2 is used). Similarly, other symmetries can be detected between b3 and b4, b5 and b10, b1 and b9 etc. Conversely, b7 and b6 are identically labelled but not symmetrical. In the next section, we show how to perform an efficient model checking using the Büchi automaton representation and the proposed symmetries.

5. Analysis of Model Checking using symmetries Classically, model checking is realized by (1) considering the Büchi automaton, A¬f of the negation of formula f to be verified; (2) building the synchronized product of this automaton and the one which models the behavior of the system; (3) searching in the synchronized product a sequence which has an accepting state repeated infinitely often in order to prove that the negation of the formula holds. The meaning of such algorithm is that one must verify that any behavior of the system validates the formula. This algorithm can work in an "on-the-fly" fashion [11] so as to avoid the construction of the whole graph of the strongly connected components.

5.1. Synchronized Product The synchronized product of M and A¬f is noted M × A¬f and is defined as follows: Definition 5.1.1: Synchronized Product The synchronized product of M=(S, ∆, I, V, D, L, S0) and A¬f =(AP, B, ρ, B0, E, F) is the automaton M × A¬f =(AP, Θ, Γ, Θ0, Φ) defined below: - Θ= { ( s, b) s ∈ S ∧ b ∈ B ∧ ( E ( b) ⊆ prop ( s) ) } ; - Θ0= { ( s, b) ∈ Θ s ∈ S0 ∧ b ∈ B0 }; - ( ( si, bi) → ( sj, bj) ) ∈ Γ iff ( si → sj) ∈ ∆ ∧ ( bi → bj) ∈ ρ . - Φ = { ( s, b) ∈ Θ s ∈ S ∧ b ∈ F}. By means of such a product, a formula f holds through M, if and only if there is no path, in M × A¬f , in which an accepting state is repeated infinitely often. Classically, the satisfaction of a formula is expressed as follows: M |= ¬f ⇔ ∃p = ( s0, b0) … ( sl, bl) … ( sm, bm) … ( sn, bn) in M × A¬f where l ≤ m < n such that: (1) bm ∈ F ; (2) ( ∀i, j ∈ I, i ≠ j, ( ( si, bi) = ( sj, bj) ⇔ { i, j} = { l, n} ) )

5.2. Quotient Structure In order to reduce the size of the synchronized product structure, we only consider canonical representatives of the symmetrical states instead of all the states. Consequently, we build a graph of representatives with respect to a symmetry relation, R, defined on M × A¬f as follows: Definition 5.2.1: Symmetry Relation, R, Defined on M × A¬f

∀s, s′ ∈ S, ∀b, b′ ∈ V such that s|=Atom(b) and s′ |=Atom( b′ ), ( s, b) R ( s′, b′) iff ∃π ∈ Aut ( M) such that bRπb′ and π(s) = s′ .

Observe that R is an equivalence relation since it is defined on the group Aut(M). Therefore, we can define the quotient structure of the synchronized product M × A¬f denoted M × A¬f = ( M × A¬f) ⁄ R as follows: Definition 5.2.2: The Quotient Structure M × A¬f The quotient structure M × A¬f is defined by means of the representatives of the state orbits of M × A¬f . The orbit of ( s, b) ∈ Θ is defined by the set:

θ ( s, b) = { ( s′, b′) ∃π ∈ Aut ( M) , ( π(s) = s′) ∧ ( bRπb′) where, s′ |= Atom(b′) }. From each orbit θ(s,b), we pick an arbitrary representative denoted ( s, b). The representative can be efficiently implemented by defining a canonical representation based on a lexicographical order [1].

5.3. Model Checking Correctness In this section we validate our approach by showing that the model checking based on the proposed quotient synchronized product is equivalent to the one performed by means of the ordinary structure. Intuitively, we prove that the existence of an accepting state repeated infinitely often in the quotient structure is equivalent to the existence of an accepting state repeated infinitely often in the ordinary synchronized product. Hence, we can prove the satisfaction of temporal logic formulas by using our approach of symmetry. We start our proof by the correspondence between both the quotient and the ordinary structures of the synchronized product. Let M × A¬f represents the structure resulting from the synchronized product of the state transition graph and the automaton and let M × A¬f = ( M × A¬f) ⁄ R be its quotient structure with respect to the relation R introduced in definition 5.2.1. For each symbolic path in the quotient structure there is an ordinary path in the synchronized product such that the corresponding states of the two paths are symmetrical with respect to R: Lemma: Correspondence Lemma ∃ ( s0, b0) , …, ( sn, bn) ∈ M × A¬f ⇔ ∃ ( s′0, b′0) , …, ( s′n, b′n) ∈ M × A¬f such that 0 ≤ ∀i ≤ n, ( s′i, b′i) R ( si, bi) Proof: the ⇐ direction is immediate from the definition of quotient structure. For the ⇒ direction , we proceed by induction on, n, the length of the path: (i) n=0, This case is very simple since for any ( s′0, b′0) such that ( s′0, b′0) R ( s0, b0) , the lemma is proved. (ii) We assume that the lemma is proved for a given length equal to n and we verify that it is proved for a length equal to n+1. Let us consider ( s0, b0) , …, ( sn, bn) in M × A¬f , and let us recall that by assumption, we have ( s′0, b′0) , …, ( s′n, b′n) in M × A¬f

such that 0 ≤ ∀i ≤ n, ( s′i, b′i) R ( si, bi) . Let us consider an edge

( sn, bn) → ( sn + 1, bn + 1) of M × A¬f , thus, ∃ ( s″n, b″n) → ( s″n + 1, b″n + 1) in M × A¬f such that ( s″n, b″n) R ( sn, bn) and ( s″n + 1, b″n + 1) R ( sn + 1, bn + 1). We have already ( s′n, b′n) R ( sn, bn) . So, ( s′n, b′n) R ( s″n, b″n) and from the definition of the relation R: ∃π, s′n = π(s″n) and b′nRπb″n . Hence, there is a state s′n + 1 = π(s″n + 1) and an automaton state b′n + 1 such that b′n + 1Rπb″n + 1 where s′n + 1 = π(s″n + 1) |= π(Atom ( b″n + 1) )= Atom ( b′n + 1) . Therefore, ( s′n + 1, b′n + 1) is a state of M × A¬f and

since,

there

is

an

arc

( s″n, b″n) → ( s″n + 1, b″n + 1) ,

the

arc

( s′n, b′n) → ( s′n + 1, bn + 1) is an arc of the same structure also. From this lemma, we now prove the equivalence of the existence of paths verifying the formula, in both the quotient and the ordinary synchronized product:

Theorem: The two following statements are equivalent: (i) There is a path ( s0, b0) … ( sl, bl) … ( sm, bm) … ( sn, bn) in M × A¬f where l ≤ m < n such that:

(1) bm ∈ F ; (2) ∀i ≠ j, ( ( si, bi) = ( sj, bj) ) ⇔ ( { i, j} = { l, n} ) .

(ii) There is a path ( s′0, b′0) … ( s′l, b′l) … ( s′m, b′m) … ( s′n, b′n) in M × A¬f where l ≤ m < n such that: (1) bm ∈ F ; (2) ∀i ≠ j, ( ( s′i, b′i) = ( s′j, b′j) ) ⇔ ( { i, j} = { l, n} ). Proof: (1)

( i) ⇒ ( ii): Let us consider ( s0, b0) … ( sl, bl) … ( sm, bm) … ( sn, bn) the shortest path that verifies (i1) in M × A¬f . From the correspondence lemma there is a corresponding path ( s′0, b′0) , …, ( s′l, b′l) , …, ( s′m, b′m) , …, ( s′n, b′n) in M × A¬f . We

prove that it verifies the following two statements: (ii1) b′m ∈ F , effectively, symmetries built on the automaton preserve accepting states; (ii2) Two directions have to be proved. The ⇒ direction is straightforward since ( s′i, b′i) = ( s′j, b′j) ⇒ ( ( si, bi) = ( sj, bj) ) , consequently we deduce from (i2 that {i,j}={l,n}. For the ⇐ direction , we have {i,j}={l,n}, so from (i2), ( si, bi) = ( sj, bj). By assumption, {i,j}={l,n}, so, ( sl, bl) = ( sn, bn) from (i2). The proof is now made by contradiction assuming that ( s′l, b′l) ≠ ( s′m, b′m) . In this case, ( s′l, b′l) R ( s′m, b′m) since their representatives are equals. Consequently, from the correspondence lemma, we have an infinite path in which there is an infinite number of subpaths of the form ( s′n + k ( n – l) , b′n + k ( n – l) ) … ( s′n + ( k + 1) ( n – l) , b′n + ( k + 1) ( n – l) ) where k=0,1,... and for l ≤ ∀i ≤ n, ( s′i + k ( n – l) , b′i + k ( n – l) ) R ( s′i, b′i). Because we deal with finite state transition graph, this infinite path must contain a circuit. Let us consider ( s′0, b′0) , …, ( s′x, b′x) , …, ( s′y, b′y) the shortest path that meets twice the same state where: ( s′x, b′x) = ( s′y, b′y) and x ≥ l, y ≥ n . To simplify the proof we consider x < y and we denote f(x)=x-k(n-l), f(y)=y-k(n-l) such that f ( x) , f ( y) ∈ [ l, n]. Since ( ( s′x, b′x) = ( s′y, b′y) ) ⇒ ( ( sx, bx) = ( sy, by) ) ⇒ ( sf ( x) , bf ( x) ) = ( sf ( y) , bf ( y) ) we have two cases. In the first one: f(x), f(y) are from [l,m[or]m,n]. By considering ( s′0, b′0) , …, ( s′l, b′l) , …, ( s′f ( x) , b′f ( x) ) , ( s′f ( y) + 1, b′f ( y) + 1) , …, ( s′m, b′m) , ( s′n, b′n) ( s′0, b′0) , …, ( s′l, b′l) , …, ( s′m, b′m) , ( s′f ( x) , b′f ( x) ) , ( s′f ( y) + 1, b′f ( y) + 1) , …, ( s′n, b′n) with respect to the position of f(x), f(y) in the domain, we have a shortest path than ( s′0, b′0) , …, ( s′l, b′l) , …, ( s′m, b′m) , ( s′n, b′n) that verifies the two conditions (ii1) and (ii2) which is opposite to the initial assumption. In the second case: f(x) is from [l,m[ and f(y) from [m,n]. By considering the following path that verify (ii1) and (ii2), ( s′0, b′0) , …, ( s′f ( x) , b′f ( x) ) , …, ( s′m, b′m) , …, ( s′f ( y) , b′f ( y) ), we have a shortest path than ( s′0, b′0) , …, ( s′l, b′l) , …, ( s′m, b′m) , ( s′n, b′n) which is

(2)

contradictory with the initial assumption. Consequently ( s′l, b′l) = ( s′m, b′m) . ( ii) ⇒ ( i): Let us consider the set of paths: Π={(s0,b0)...(sl,bl)...(sm,bm)...(sn,bn) such that (sl,bl) R (sm,bm) and bm ∈ F }. Π ≠ ∅ from the assumption (i1). Let us consider π=(s0,b0)...(sn,bn) one of the shortest path of Π. From the correspondence lemma, ∃π = ( s′0, b′0) … ( s′n, b′n) a representative path where ( si, bi) R ( s′i, b′i). Consequently, π verifies (i1) ( s′l, b′l) = ( s′n, b′n) and (i2) b′m ∈ F . We We ∀ { i, j} ≠ { l, n} ⇒ ( s′i, b′i) ≠ ( s′j, b′j).

have to prove suppose

that, that

∃ { i, j} ≠ { l, n} , ( s′i, b′i) = ( s′j, b′j), hence, either, ( s′i, b′i) = ( s′j, b′j) which is impossible from (ii2), or, ( s′i, b′i) R ( s′j, b′j) . Hence, three cases can appear. in the first one we have ( i < j ≤ l) ∨ ( l ≤ i < j < m) ∨ ( m < i < j < n): by considering the path (s0,b0)...(si,bi)(sj+1,bj+1)...(sn,bn) we have a shortest path than π belonging to Π which is opposite to the initial assumption. In the second case we have i