Download
1 / 36
360 likes | 611 Views
Model Checking Lecture 3. Specification Automata. Syntax, given a set A of atomic observations:. S finite set of states S 0 S set of initial states S S transition relation : S PL(A) where the formulas of PL are ::= a | | for a A.
E N D
Model Checking Lecture 3
Specification Automata Syntax, given a set A of atomic observations: • S finite set of states • S0 S set of initial states • S S transition relation • : S PL(A) where the formulas of PL are ::= a | | for a A
Specification Omega Automata Syntax as for finite automata, in addition the following acceptance condition: Buchi: BA S
Language L(M) of specification omega-automaton M = (S, S0, , , BA ) : infinite trace t0, t1, ... L(M) iff there exists an infinite run s0 s1 ... of M such that 1. s0 s1 ... satisfies BA 2. for all i 0, ti |= (si)
Let Inf(s) = { p | p = si for infinitely many i }. The infinite run s satisfies the acceptance condition BA iff Inf(s) BA
Linear semantics of specification omega automata: omega-language containment (K,q) |=L M iff L(K,q) L(M) infinite traces
Response specification automaton : (a b) assuming (a b) = false s1 a b s2 s0 b a s3 Buchi condition { s0, s3 }
Response monitor automaton : (a b) assuming (a b) = false true a b s0 s1 s2 Buchi condition { s2 }
Outline • 1 Specifications: logic vs. automata, linear vs. branching, safety vs. liveness • 2 Graph algorithms for model checking • Symbolic algorithms for model checking • Pushdown systems
Safety: • -solve: finite monitors ( emptiness) • -algorithm: reachability (linear) • Liveness: • -solve: Buchi monitors ( emptiness) • -algorithm: strongly connected components (linear) We will talk about STL and CTL model checking later.
From specification automata to monitor automata: determinization (exponential) + complementation (easy) From LTL to monitor automata: complementation (easy) + tableau construction (exponential)
Algorithms • Reachability • Strongly connected components • Tableau construction
Finite Emptiness Given: finite automaton (S, S0, , , FA) Find: is there a path from a state in S0 to a state in FA ?
State-transition graph K • Q set of states • Q Q transition relation [ ]: Q 2A observation function
Monitor automaton M • S finite set of states • S0 S set of initial states • S S transition relation E S set of final states • : S PL(A) where the formulas of PL are ::= a | | for a A
languages over finite traces (K,q) |=C M iff L(K,q) L(M) = We construct another monitor automaton M’ such that L(M’) =L(K,q) L(M) S’ = {(q,s) Q S | [q] |= (s)} finite set of states ({q} S0) S’ set of initial states (q,s) (q’,s’) transition relation iff q q’ and s s’ (Q E) S’ set of final states ’: S’ PL(A) labeling function ’(q,s) = conjunction of atomic observations in [q] and negated atomic observations not in [q]
Finite Emptiness Given: monitor automaton (S, S0, , , E) Find: is there a path from a state in S0 to a state in E ? Solution: depth-first or breadth-first search
dfs(s) { if (s E) then report error add s to dfsTable for each successor t of s if (t dfsTable) then dfs(t) }
Buchi Emptiness Given: Buchi automaton (S, S0, , , BA) Find: is there an infinite path from a state in S0 that visits some state in BA infinitely often ?
Monitor Buchi automaton M • S finite set of states • S0 S set of initial states • S S transition relation BA S acceptance condition • : S PL(A) where the formulas of PL are ::= a | | for a A
languages over infinite traces (K,q) |=C M iff L(K,q) L(M) = We construct another monitor Buchi automaton M’ such that L(M’) =L(K,q) L(M) S’ = {(q,s) Q S | [q] |= (s)} finite set of states ({q} S0) S’ set of initial states (q,s) (q’,s’) transition relation iff q q’ and s s’ (Q BA) S’ acceptance condition ’: S’ PL(A) labeling function ’(q,s) = conjunction of atomic observations in [q] and negated atomic observations not in [q]
Buchi Emptiness Given: Buchi automaton (S, S0, , , BA) Find: is there an infinite path from a state in S0 that visits some state in BA infinitely often ? Solution: 1. Compute SCC graph by depth-first search 2. Mark SCC C as fair iff C BA 3. Check if some fair SCC is reachable from S0
Complexity n number of states m number of transitions Reachability: O(n+m) SCC: O(n+m)
Buchi emptiness • Two algorithms for SCC computation • forward and backward DFS • forward HI-LO algorithm • Storing SCCs requires lot of memory • Nested DFS • checks Buchi emptiness without explicitly computing SCCs
dfs(s) { add s to dfsTable for each successor t of s if (t dfsTable) then dfs(t) if (s BA) then { seed := s; ndfs(s) } } ndfs(s) { add s to ndfsTable for each successor t of s if (t ndfsTable) then ndfs(t) else if (t = seed) then report error }
Multi-Buchi Emptiness Given: Multi-Buchi automaton (S, S0, , , BA1, …, BAn) Find: is there an infinite path from a state in S0 that infinitely often visits some state in BAi for all i such that 1 i n ? Solution: 1. Compute SCC graph by depth-first search 2. Mark SCC C as fair iff C BAi for all i such that 1 i n. 3. Check if some fair SCC is reachable from S0
Tableau Construction Given: LTL formula Find: Multi-Buchi automaton M such that L(M) = L() monitors subformulas of [Fischer & Ladner 1975; Manna & Wolper 1982]
Negation normal form ( ) = ( ) = () = () ( U ) = ( W ) ( W ) = ( U ) , ::= a | a | | | | U | W
Fischer-Ladner Closure of a Formula Sub (a) = { a, a } Sub (a) = { a, a } Sub () = { } Sub () Sub () Sub () = { } Sub () Sub () Sub () = { } Sub () Sub (U) = { U, (U) } Sub () Sub () Sub (W) = { W, (W) } Sub () Sub () | Sub () | = O(||)
s Sub () is consistent iff -for all atomic propositions a (a) s iff a s -if () Sub () then () s iff s and s -if () Sub () then () s iff either s or s -if (U) Sub () then (U) s iff either s or s and (U) s -if (W) Sub () then (W) s iff either s or s and (W) s
Fischer-Ladner Closure of a Formula … … Sub () = {, } Sub () Sub () = {, } Sub ()
s Sub () is consistent iff … -if () Sub () then () s iff either s or s -if () Sub () then () s iff s and s
Tableau M = (S, S0, , , BA1,…,BAn) S ... set of consistent subsets of Sub () s S0 iff s s t iff for all () Sub (), if () s then t (s) ... conjunction of atomic observations in s and negated atomic observations not in s There is an acceptance condition - for each (U) Sub () given by { s | s or (U) s } - for each () Sub () given by { s | s or () s }
Size of M is O(2||). LTL model checking: PSPACE-complete
