On the Complexity of Partial Order Trace Model Checking

Transcription

1 On the Complexty of Partal Order Trace Model Checkng Therry Massart Cédrc Meuter Laurent Van Begn Unversté Lbre de Bruxelles (U.L.B.), Boulevard du Tromphe, CP-212, 1050 Bruxelles, Belgum Keywords: computatonal complexty, dstrbuted systems, formal methods 1 Introducton The desgn of a dstrbuted system s known to be a dffcult task whch can be eased by varous technques ncludng valdaton and debuggng. The model-based desgn abstracts the actons the system can do nto events whch change ts global state. Dependng on the varous assumptons the desgner can make, the model can be ether centralzed, provdng a global observaton and control on the entre system or dstrbuted where each event s local to some process and asynchronous communcatons allow the concurrent processes to communcate. The model valdaton checks that t has the requred propertes, usually expressed by temporal logc formulae, e.g. n Ctl, Ctl or Ltl [2]. In practce, ths abstracton s generally not suffcent to avod the state-exploson problem whch prevents the desgner from exhaustvely verfyng the whole system, even wth effcent exploraton technques such as partal order reducton or symbolc model checkng [2]. The desgner may therefore want to analyse or valdate smpler models whch descrbe only some facets of the system. As such, t may be mportant, durng the early desgn phases, to check scenaros expressed for nstance by Message Sequence Charts [5]. Durng the testng and deployment phases, executons must be valdated; runtme verfcaton technques [4] are typcally desgned for that purpose. The practcal valdty of these methods depend on the number of test-cases, to gve a reasonable confdence that the system s correct. Therefore, theoretcal and practcal effcency Supported by the Belgan Scence Polcy IAP-Phase VI: MoVES and Centre Fédéré en Vérfcaton (FNRS- FRFC n ) Research fellow supported by the Belgan Natonal Scence Foundaton (FNRS). 1

2 of the algorthms able to solve the problem are crucal. In the centralzed case, an executon of the system s a sequence of events. The complexty of determnng f such an executon satsfes a property has been studed n [7] where t s shown that the problem can be solved effcently. In the dstrbuted case, the exact order n whch two concurrent events occur n the executon s, n general, not always known or guaranteed. By takng nto account the communcatons between processes, however, a partal order on the events of the executon can stll be obtaned. Hence n ths case, an executon can be vewed as a partally ordered set of events called partal order trace. The global propertes satsfacton on these partal order traces has been wdely studed snce the 90 s. Chase and Garg have shown n [1], that the global predcate detecton problem,.e. the reachablty of a system s state whch satsfes some global predcate, s NP-complete for an arbtrary predcate, even when there s no nter-process communcaton. However, varous classes of propertes can be checked effcently n polynomal tme (see e.g. [3, 6] whch relates these methods). Sen and Garg extended the study to temporal operators and defned the RCtl logc [9], a restrcted form of Ctl whose model checkng s polynomal on partal order traces. In prevous works, we developed symbolc Ltl [3] and Ctl [6] model checkng of partal order traces and showed ther effcency n practce. We study here the theoretcal complexty of Ctl, Ctl and Ltl model checkng over fnte partal order traces. We show that over such partal order traces, Ctl and Ctl model checkng are PSPACE-complete and that the Ltl model checkng s conp-complete. 2 Basc defntons In ths secton, we recall the satsfablty problems for propostonal and quantfed propostonal formulae. In the rest of the paper, we assume an nfnte and countable set P of propostons and B denotes the set of Boolean values,.e. B = {tt, ff} where tt stands for true and ff for false. Propostonal Boolean Formulae A Propostonal Boolean Formula (PBF) φ s defned usng the followng grammar: φ ::= p φ φ φ, where denotes the true formula, and p P. Moreover, let denotes the formula (the false formula). Other standard Boolean operators (,, ) are derved as usual. The (fnte) set of propostons appearng n a PBF formula φ s denoted by P(φ). A PBF φ s nterpreted usng a valuaton of P(φ),.e. a functon v : P(φ) B. The satsfacton of a PBF φ by a valuaton v, noted v = φ, s defned as usual. The PBF φ s satsfable f there exsts a valuaton v such that v = φ. The sze of the PBF φ, noted φ, s defned nductvely as follows: () f φ = or φ = p then φ = 1, () f φ = φ 1 then φ = φ and () f φ = φ 1 φ 2 then φ = φ 1 + φ Fnally, gven a PBF φ, the PBF-SAT problem conssts n determnng f φ s satsfable. Ths problem s known to be NP-complete [8]. 2

3 Quantfed Boolean Formulae A Quantfed Boolean Formula (QBF) ψ s a formula of the form Q 1 p 1 Q 2 p 2... Q r p r φ where () φ s a PBF over P and () Q {, } and p P(φ) for [1, r]. Note that a PBF s a QBF wthout quantfers (r = 0). In the followng, we assume that each proposton s quantfed at most once. A fully QBF s a QBF where all propostons are quantfed. QBF are also nterpreted over valuatons. As n the PBF case, P(ψ) denotes the set of propostons appearng n the QBF ψ. A valuaton v : P(ψ) B satsfes a QBF ψ s noted v = ψ. The satsfacton s derved from the propostonal case as follows. If ψ = p ψ, then v = ψ ff v[p tt] = ψ and v[p ff] = ψ and, f ψ = p ψ, then v = ψ ff v[p tt] = ψ or v[p ff] = ψ. Note that the truth value of a QBF formula ψ depends only on the valuaton of ts free propostons,.e. those used n ψ and not lnked by a quantfer. In partcular, f ψ s a fully QBF, ts truth value does not depend on v. Smlarly to PBF, a QBF ψ s satsfable f there exsts a valuaton v such that v = ψ. The sze of a QBF ψ = Q 1 p 1 Q 2 p 2... Q r p r φ where φ s a PBF, noted ψ, s equal to φ. Note that the number of quantfers n ψ s bounded by φ. Gven a (fully) QBF ψ, the QBF-SAT problem conssts n decdng f ψ s satsfable. Ths problem s known to be PSPACE-complete, even for fully QBF [8]. 3 Ctl, Ctl and Ltl over partal order traces Partal Order Traces A partal order trace (po-trace) s a tuple T = E, P 0, α, β, where () E s a fnte set of events; () P 0 P s the fnte set of propostons ntally true; () α : E 2 P (resp. β : E 2 P ) s a functon gvng for each event e the fnte set of propostons set to tt (resp. ff) such that e E : α(e) β(e) = ; and () E E s a partal order relaton on E such that e, e E: ((α(e) β(e)) (α(e ) β(e )) ) (e e ) (e e),.e. f the truth value of at least one proposton s modfed by two events, then those events must be ordered. Gven an event e E, we defne e = {e E e e}, the past of e (ncludng e tself). The fnte ( ) set of propostons used by T s denoted by P(T ),.e P(T ) = P 0 e E α(e) β(e). A cut s a subset C E such that e C : e C. The set of cuts s denoted by cuts(t ). Gven a cut C cuts(t ), we defne enabled(c) = {e E \ C ( e \ {e}) C} the set of events enabled n C, and C /p = {e C p α(e) β(e)} the set of events of C that modfes the truth value of p. Note that for every proposton p, the set C /p s totally ordered. The set of propostons true n a cut C, noted P C s then defned as {p P(T ) (C /p = p P 0 ) (C /p p α(max(c /p ))}. If an event e s enabled n the cut C, then t can be fred from C leadng to C = C {e}, noted C C. A path σ s a sequence σ = C 0... C k cuts(t ) such that k 0 and [0, k) : C C +1. The sze σ of the sequence σ s the number of frngs from C 0 n σ (.e. k here) 1 ; and we note σ the suffx C, C +1,... C k. σ s left undefned f > σ. A run from a cut C s a path σ = C 0... C k 1 Note that σ could also have been defned as ts number of states (.e. k + 1 here) 3

4 wth () C 0 = C and () C k = E. The set of runs startng n a cut C cuts(t ) s denoted by runs(c). The sze of the po-trace T = E, P 0, α, β,, noted T, s equal to E + + P(T ). Ctl Formulae n the temporal logc Ctl are defned usng the followng grammar: Ψ ::= p Ψ Ψ Ψ Φ Φ Φ ::= Ψ Φ Φ Φ ΦUΦ Φ where Ψ s a state formula, Φ s a path formula, p P, U s the untl operator and s the next operator. Other Boolean constructs (,,, ) are defned as n the PBF case. In our case, Ctl state (resp. path) formulae are nterpreted over cuts C (paths σ) of a po-trace T. The satsfacton relaton, noted = C (resp. = σ ) for state (resp. path) formulae, s the smallest relaton that satsfes the followng: T, C = C T, C = C p p P C T, C = C Ψ ff T, C = C Ψ T, C = C Ψ 1 Ψ 2 ff T, C = C Ψ 1 T, C = C Ψ 2 T, C = C Φ ff σ runs(c) : T, σ = σ Φ T, C = C Φ ff σ runs(c) : T, σ = σ Φ T, σ = σ Ψ ff T, C 0 = C Ψ T, σ = σ Φ ff T, σ = σ Φ T, σ = σ Φ 1 Φ 2 ff T, σ = σ Φ 1 T, σ = σ Φ 2 T, σ = σ Φ ff σ > 0 T, σ 1 = σ Φ T, σ = σ Φ 1 UΦ 2 ff [0, σ ] : (( T, σ = σ Φ 2 ) ( j [0, ) : T, σ j = σ Φ 1 )) where σ = C 0... C k, Φ, Φ 1, Φ 2 are path formulae and Ψ, Ψ 1, Ψ 2 are state formulae. A po-trace T satsfes a Ctl state formula Ψ, noted T = Ψ, ff T, = C Ψ. The sze of a Ctl formula Ψ, noted Ψ, s defned nductvely as follows: () f Ψ = or Ψ = p then Ψ = 1; () f Ψ = Ψ 1, Ψ = Ψ 1, Ψ = Ψ 1 or Ψ = Ψ 1 then Ψ = Ψ 1 + 1; f Ψ = Ψ 1 Ψ 2 or Ψ = Ψ 1 UΨ 2 then Ψ = Ψ 1 + Ψ Ctl has n partcular two useful fragments : Computaton Tree Logc (Ctl) s a fragment of Ctl n whch each and U operators must be mmedately preceded by a path quantfer. Formally, a Ctl formula Ψ s defned usng the grammar : Ψ ::= p Ψ Ψ Ψ Ψ Ψ [ΨUΨ] [ΨUΨ] Lnear Tme Logc (Ltl) s another fragment of Ctl n whch each formula has the form Φ and the only state sub-formulae permtted are and atomc propostons p P. Formally, a Ltl formula Ψ s defned usng the grammar : Ψ ::= Φ Φ ::= p Φ Φ Φ Φ ΦUΦ Gven a po-trace T and a formula Ψ, the model checkng problem conssts n determnng f T = Ψ. In the remander of the paper, we nvestgate the complexty of the model checkng problem for Ctl, Ctl and Ltl formulae. 4

5 4 Ctl and Ctl Model Checkng We start wth the model checkng problem for Ctl and Ctl. Frst, we wll show that for Ctl, the problem s PSPACE-hard. Snce Ctl s a fragment of Ctl, t mples that the problem for Ctl s also PSPACE-hard. Then, we show that, for Ctl, the problem s PSPACE-easy. Agan, snce Ctl s a fragment Ctl, t follows that the problem for Ctl s also PSPACE-easy. Those results allow us to conclude that for Ctl and Ctl, the model checkng problem s PSPACE-complete. In order to prove that for Ctl, the model checkng problem s PSPACE-hard, we exhbt a polynomal reducton of (fully) QBF-SAT. that works as follows. Let ψ be a fully QBF wth P(ψ) = {p 1,..., p r }. We buld a po-trace T P(ψ) and a Ctl formula Ψ ψ and prove that ψ s satsfable ff T P(ψ) = Ψ ψ. The po-trace T P(ψ) = E, P 0, α, β, s bult over set of propostons [1,r] {q, q } as follows: () E = [1,r] {e, e }; () P 0 = ; () [1, r] : α(e ) = {q } β(e ) = α(e ) = {q } β(e ) = and fnally (v) =. The Ctl formula Ψ ψ s defned nductvely as follows: ψ[p 1 eval tt 1,..., p r eval tt r ] Ψ ψ = f ψ s a PBF ((eval tt eval ff ) Ψ ψ1 ) f ψ = p ψ 1 ((eval tt eval ff ) Ψ ψ1 ) f ψ = p ψ 1 where eval tt = (q q ), evalff = ( q q ), and where ψ[p 1 φ 1,..., p r φ r ] denotes the formula ψ where every occurrence of proposton p s replaced by the formula φ for [1, r]. As a frst remark, t s clear that the szes of Ψ ψ and T P(ψ) are polynomal n the sze of ψ. Indeed, each proposton n ψ s replaced by a sub-formula of (constant) sze 4 and each quantfcaton s replaced by a construct of (constant) sze 12. In the followng, for any [1, r], we note C tt = {e }, resp. C ff = {e }, the mnmal cut satsfyng evaltt, resp. eval ff. Formally, T P(ψ), C tt = C eval tt and T P(ψ), C ff = C eval ff snce P C tt = {q } and P C ff = {q }. Lemma 1 Gven a fully QBF ψ, T P(ψ) = Ψ ψ ff ψ s satsfable. Proof. We prove by nducton on P(ψ) that ψ s satsfable ff T P(ψ), = C Ψ ψ. Base cases. If P(ψ) = 0, then P(ψ) = and ψ s a Boolean combnaton of. If ψ, by defnton of Ψ ψ we have Ψ ψ = ψ[p 1 eval tt 1,..., p r eval tt r ] = ψ. In ths case, we have that T P(ψ), = C Ψ ψ. If ψ, Ψ ψ, hence T P(ψ), = C Ψ ψ. We conclude that T P(ψ), = C Ψ ψ ff ψ s satsfable. Inducton cases. We have to consder two cases: The frst case s when ψ = p ψ 1. In ths case, ψ s satsfable ff ψ 1 [p ] or ψ 1 [p ] s satsfable. By nducton, ths s 5

6 equvalent to T P(ψ)\{p}, = C Ψ ψ1[p ] or T P(ψ)\{p}, = C Ψ ψ1[p ]. By defnton of Ψ ψ1, ths holds ff T P(ψ)\{p}, = C Ψ ψ1 [q, q ] or T P(ψ)\{p }, = C Ψ ψ1 [q, q ], and by defnton of C tt and C ff, ff T P(ψ), C tt = C Ψ ψ1 or T P(ψ), C ff = C Ψ ψ1. Now snce C tt (resp. C ff ) contans the only event that can satsfy evaltt (resp. eval ff ), we deduce that T P(ψ), C b = C Ψ ψ1 ff T P(ψ), = C (eval b Ψ ψ1 ) for any b B. We can therefore conclude that ψ s satsfable ff T P(ψ), = C (eval tt Ψ ψ1 ) or T P(ψ), = C (eval ff Ψ ψ1 ), or equvalently f T P(ψ), = C ( (eval tt s equvalent to ((eval tt eval ff ) Ψ ψ1 ) = Ψ ψ. Ψ ψ1 )) ( (eval ff Ψ ψ1 )). Fnally, ths last formula The second case s when ψ = p ψ 1. In ths case, ψ s satsfable ff ψ 1 [p ] and ψ 1 [p ] are satsfable. Smlarly to the frst case, by nducton, defnton of Ψ ψ1, C tt and C ff, ths holds ff T P(ψ), C tt = C Ψ ψ1 and T P(ψ), C ff = C Ψ ψ1. Note that for any cuts C such that C ether C = C b wth b B and C = evalb, or C = eval tt eval ff. We deduce that T P(ψ), C b = C Ψ ψ1 ff T P(ψ), = C (eval b Ψ ψ1 ) for any b B. We can therefore conclude that ψ s satsfable ff T P(ψ), = C (eval tt Ψ ψ1 ) and T P(ψ), = C (eval ff Ψ ψ1 ), or equvalently f T P(ψ), = C ( (eval tt Ψ ψ1 )) ( (eval ff Ψ ψ1 )). Fnally, the last formula s equvalent to ((eval ff eval tt ) Ψ ψ1 ) = Ψ ψ. From Lem. 1, we get the PSPACE-hardness for Ctl. Proposton 1 The model checkng problem over po-traces s PSPACE-hard for Ctl. Proof. Snce QBF-SAT s PSPACE-complete, Ψ ψ and T P(ψ) have sze polynomal w.r.t. the sze of a fully QBF ψ, we conclude by Lem. 1 that the proposton holds. Now, we show PSPACE-easness of the model checkng problem for Ctl by exhbtng a polynomal space algorthm that solves the problem. Proposton 2 The model checkng problem over po-traces s PSPACE-easy for Ctl Proof. Frst, we exhbt a recursve algorthm that takes a partal order trace T = E, P 0, α, β,, a Ctl state formula Ψ wth a cut C (resp. a Ctl trace formula Ψ wth a run σ = C 0 C 1... C k wth C = C 0 ), and returns true f and only f T, C = C Ψ (resp. T, σ = σ Ψ). The recurson follows the structure of the nference whch shows T, C = C Ψ or T, σ = σ Ψ. Then, we show nductvely on the depth of the recurson, that ths algorthm s polynomal space w.r.t. the sze of the formula Ψ and the sze of the po-trace T. Base cases. When Ψ = or Ψ = p. In the frst case, the algorthm always returns true. In the second case, f Ψ s a state formula then t bulds P C and returns true ff p P C. Inducton cases If σ contans sub-formulae, then the algorthm works as follows: Frst, f Ψ s evaluated on a trace σ = C 0... C k but t s not of the form Ψ 1 Ψ 2, Ψ 1, Ψ 1 or Ψ 1 UΨ 2, then Ψ s also a state formula and the algorthm returns true ff T, C 0 = C Ψ. 6

7 If Ψ = Ψ 1, Ψ = Ψ 1 Ψ 2, then Ψ 1 and Ψ 2 are frst evaluated and then the algorthm evaluates Ψ accordng to the usual semantcs of boolean connectors. If Ψ = QΨ 1 wth Q {, }, then Ψ s a state formula. In ths case, the algorthm enumerates all the runs σ runs(c) and then checks f T, σ = σ Ψ 1 holds. In the case where Q = (resp. Q = ), the algorthm returns true ff at least one run σ runs(c) (resp. all the runs σ runs(c)), s such that T, σ = σ Ψ 1. f Ψ = Ψ 1 then the algorthm returns true ff T, C 1... C k = σ Ψ 1 holds. f Ψ = Ψ 1 U Ψ 2, then Ψ s a path formula. For each 0 k, the algorthm frst consders the sub-formula Ψ 2 and checks f T, C... C k = σ Ψ 2 holds. If t s the case, the algorthm consders Ψ 1 and checks f T, C j... C k = σ Ψ 1 holds for all 0 j <. In the case of a postve answer for all 0 j <, the algorthm returns true. Fnally, f the algorthm does not conclude for any 0 k then t returns false. Let us now show that the algorthm uses only a polynomal space w.r.t. the sze of the formula Ψ and the sze of the partal order trace T. To smplfy the presentaton, we do not care about the memory used to store one cut, P C,.... However, t s mmedate that the memory used can be bounded by a polynomal n the sze of T by usng, for nstance, bt vectors to represent sets. More precsely, we show that the number of cuts that are computed and stored at the same tme nto memory by the algorthm s bounded by T Ψ. The proof s by nducton on the depth of the recurson of the algorthm used. Base cases If Ψ =, then the algorthm returns true n constant tme wthout buldng cuts, hence the result. If Ψ = p then Ψ s evaluated on the cut C and the algorthm bulds P C. Ths can be acheved n polynomal tme wthout buldng new cuts by frst computng for each p P(T ) the set C /p. Ths can be done by enumeratng the events e C and checks f p α(e) β(e) (ths can also be done by enumeratng α and β). If C /p s empty then p s n P C ff p P 0 (ths can be checked by enumeratng the elements of P 0 ). Otherwse, we fnd the maxmal element e max w.r.t n C /p by enumeratng the elements n C /p and. Fnally, p s n P C ff p α(e max ). Snce 0 T Ψ, we conclude. Inducton cases If Ψ = Ψ 1 or Ψ = Ψ 1 Ψ 2 then by nducton hypothess we know that the algorthm evaluates Ψ 1 and Ψ 2 (on runs or cuts) storng at most T ( Ψ 1) cuts (snce Ψ < Ψ for {1, 2}), hence t evaluates Ψ by storng at most T ( Ψ 1) T Ψ cuts. If Ψ = QΨ 1 wth Q {, }, then the algorthm enumerates all the runs σ runs(c). Ths can be done as follows: From C ntally equal to C, we enumerate the events e E and then test f e enabled(c ) and f there s no (e, e) such that e C by enumeratng the elements of and C. If t s the case, we terate from the cut C {e} untl we buld E. At each step, the algorthm only keeps n memory the cuts of the current nvestgated run. Snce the sze of 7

8 the runs are bounded by E, hence bounded by T, the number of cuts stored n memory when enumeratng all the runs σ runs(c) s bounded by T. Then, by nducton hypothess, the algorthm uses memory bounded by T Ψ 1 to check f T, σ = σ Ψ 1 holds. Snce Ψ = Ψ, we conclude that the algorthm mantans at most T Ψ cuts n memory when evaluatng Ψ. If Ψ = Ψ 1, the algorthm evaluates Ψ 1 on a trace. By nducton hypothess, ths s acheved by storng at most Ψ 1 T cuts. Furthermore, the trace over whch Ψ 1 s evaluated has sze bounded by T. Snce Ψ = Ψ 1 + 1, we conclude that the algorthm stores at most Ψ T cuts. If Ψ = Ψ 1 U Ψ 2, then assume that Ψ s evaluated on the run σ. By nducton hypothess, the number of cuts stored n memory when evaluatng Ψ 1, resp. Ψ 2, on sub-sequences of σ s bounded by T Ψ 1, resp. T Ψ 2. Furthermore, Ψ 1 and Ψ 2 are evaluated on traces wth sze bounded by T. Snce Ψ 1 < Ψ and Ψ 2 < Ψ, we conclude that the number of cuts stored n memory by the algorthm when checkng Ψ s bounded by Ψ T. Fnally, n the case where the algorthm has to evaluate a formula Ψ on the trace C 0... C k that s not of the form Ψ 1, Ψ 1 Ψ 2, Ψ 1 or Ψ 1 UΨ 2, then the algorthm evaluates Ψ on C 0 as explaned above and we drectly conclude from the prevous cases. From Propostons 1 and 2, and snce Ctl s a subset of Ctl, we conclude that the followng theorem holds. Theorem 1 The model checkng problem over po-trace s PSPACE-complete for Ctl and Ctl. 5 Ltl Model Checkng We now prove that the model checkng problem for the lnear-tme temporal logc Ltl s conpcomplete on po-traces. For that purpose, we examne the dual problem of model checkng LTL formulae,.e. formulae of the form Φ where Φ s a restrcted path formula, as defned n the grammar of LTL. We frst show that ths problem s NP-easy. Proposton 3 The model checkng over po-traces s NP-easy for LTL Proof. We exhbt a non-determnstc polynomal tme algorthm. The algorthm works as follows: t frst guesses a run σ of the po-trace T, and then checks that the formula holds on that run. The algorthm starts from C =, and for each cut of the run t guesses an event e, checks that e enabled(c ) and then bulds the next cut C {e}. The test e enabled(c ) can be acheved n polynomal tme by enumeratng the events of C to ensure that e C and then enumerate the elements of (together wth those of C ) to ensure that e e mples that e C. Fnally, note that the sze of a run n runs( ) has sze E. Fnally, Ltl model-checkng on a run can solved n polynomal tme [7, Proposton 3.3]. 8

9 Next, we show that the model checkng problem s NP-hard for LTL. For that, we reduce the global predcate detecton whch s known NP-complete [1]. In our framework, ths problem can be stated as follows. Gven a po-trace T and a PBF φ over P(T ), the global predcate detecton conssts n determnng f C cuts(t ) : T, C = C φ. Proposton 4 The model checkng problem over po-traces s NP-hard for LTL. Proof. Gven a po-trace T, and a PBF φ, t s mmedate that C cuts(t ) : T, C = C φ f and only f T = ( Uφ). We can therefore conclude that the model checkng problem s NP-complete for LTL and therefore conp-complete for Ltl, as stated n the followng theorem. Theorem 2 The model checkng problem over po-traces s conp-complete for Ltl. Hence theorem 1 and 2 show that contrarly to complete systems (Krpke structures) [2], over po-traces, Ltl has a lower complexty that Ctl and Ctl. References [1] C. M. Chase, V. K. Garg, Detecton of global predcates: Technques and ther lmtatons., Dstrbuted Computng 11 (4) (1998) [2] E. Clarke, O. Grumberg, D. Peled, Model Checkng, The MIT Press, [3] A. Genon, T. Massart, C. Meuter, Montorng dstrbuted controllers: When an effcent ltl algorthm on sequences s needed to model-check traces., n: J. Msra, T. Npkow, E. Sekernsk (eds.), FM, vol of LNCS, Sprnger, [4] K. Havelund, Usng runtme analyss to gude model checkng of java programs., n: K. Havelund, J. Penx, W. Vsser (eds.), SPIN, vol of LNCS, Sprnger, [5] ITU-TS, ITU-TS Recommendaton Z.120: Message Sequence Chart (MSC), Geneva (1999). [6] G. Kalyon, T. Massart, C. Meuter, L. V. Begn, Testng dstrbuted systems through symbolc model checkng., n: J. Derrck, J. Van (eds.), FORTE, vol of Lecture Notes n Computer Scence, Sprnger, [7] N. Markey, P. Schnoebelen, Model checkng a path., n: R. M. Amado, D. Lugez (eds.), CONCUR, vol of LNCS, Sprnger, [8] C. H. Papadmtrou, Computatonal Complexty, Addson Wesley Longman, [9] A. Sen, V. K. Garg, Detectng temporal logc predcates n dstrbuted programs usng computaton slcng., n: M. Papatrantaflou, P. Hunel (eds.), OPODIS, vol of LNCS, Sprnger,