Automata on Infinite words and LTL Model Checking

Transcription

1 Automata on Infinite words and LTL Model Checking Rodica Condurache Lecture 4 Lecture 4 Automata on Infinite words and LTL Model Checking 1 / 35

2 Labeled Transition Systems Let AP be the (finite) set of atomic propositions 2 AP is the (finite) alphabet Definition A Labeled Transition System (LTS) is a tuple T = AP, S, S 0, R, τ where AP is the set of labels (atomic propositions) S is the finite set of states S 0 S is the set of initial states R S S is the transition relation τ : S 2 AP is the labeling function (each state is labeled with a set of propositions!) Lecture 4 Automata on Infinite words and LTL Model Checking 2 / 35

3 Labeled Transition Systems A (finite or infinite) run ρ in T is a sequence ρ = s 0s 1s 2... where s 0 S 0 is an initial state of T i 0, (s i, s i+1 ) R For ρ a run in T, trace(ρ) = τ(s 0)τ(s 1)τ(s 2)... Traces(T ) = {trace(ρ) ρ a run in T } is the set of traces of T Use Regular Expressions to express properties for finite runs (see LFA course) Linear-time Temporal Logic(LTL) can express properties on infinite runs Lecture 4 Automata on Infinite words and LTL Model Checking 3 / 35

4 Linear-time Temporal Logic - Syntax LTL = propositional calculus + temporal extension Temporal operators: X ( next ); U( until ) Definition (LTL syntax) Given a set AP of atomic propositions, a LTL formula over AP is defined by the following syntax: ϕ ::= p ϕ ϕ ϕ X ϕ ϕuϕ where p AP. We can define the following macros: ϕ 1 ϕ 2 = ( ϕ 1 ϕ 2) (ϕ 1 and ϕ 2) ϕ 1 ϕ 2 = ϕ 1 ϕ 2 (ϕ 1 implies ϕ 2) ϕ 1 ϕ 2 = (ϕ 1 ϕ 2) (ϕ 2 ϕ 1) (ϕ 1 equivalent to ϕ 2) F ϕ = true Uϕ ( eventually ϕ) Gϕ = F ϕ ( always ϕ) ϕ 1Rϕ 1 = Gϕ 1 ϕ 1Uϕ 2 (ϕ 1 releases ϕ 2) Lecture 4 Automata on Infinite words and LTL Model Checking 4 / 35

5 Linear-time Temporal Logic - Semantic LTL formulas are evaluated over infinite words w = w 0w 1w 2... (2 AP ) ω Definition LTL Semantics Given a word w = w 0w 1w 2... (2 AP ) ω and a position i 0, w, i = p iff p w i w, i = ϕ iff w, i = ϕ w, i = ϕ 1 ϕ 2 iff w, i = ϕ 1 or w, i = ϕ 2 w, i = X ϕ iff w, i + 1 = ϕ w, i = ϕ 1Uϕ 2 iff j i s.t. w, j = ϕ 2 and w, k = ϕ 1 for all i k < j The language of ϕ: L(ϕ) = {w (2 AP ) ω w, 0 = ϕ} Lecture 4 Automata on Infinite words and LTL Model Checking 5 / 35

6 LTL Model checking Verify that T satisfies LTL formula ϕ: Traces(T ) L(ϕ) Traces(T ) L( ϕ) = Use automata to encode the language of ϕ We build an automaton A ϕ s.t. A ϕ accepts w iff w L(ϕ) Lecture 4 Automata on Infinite words and LTL Model Checking 6 / 35

7 Nondeterministic Büchi word automata (NBA) Definition (Nondeterministic Büchi word automata) A Nondeterministic Büchi automaton accepting words over 2 AP is a tuple A = 2 AP, Q, Q 0, δ, T where 2 AP is the alphabet Q is the set of states Q 0 Q is the set of initial states δ Q 2 AP Q is the transition relation T Q is the set of accepting states i.e. just like a nondeterministic finite automaton (NFA) (see LFA) The difference is the accepting condition... Lecture 4 Automata on Infinite words and LTL Model Checking 7 / 35

8 Runs of a NBA Example Consider a Büchi automaton A = 2 AP, Q, Q 0, δ, T A run of A on an infinite word w = w 0w 1w 2... is an infinite sequence q 0q 1q 2... Q ω s.t. q 0 Q 0 is an initial state of A and (q i, w i, q i+1 ) δ for all i 0 w = ({a}{b}{b}) ω ρ = q 0 a q 1 b q 0 b q 0 a q 1 b q 0... Let inf(ρ) be the set of states that appear infinitely often in ρ: inf(ρ) = {q i 0, j i s.t. ρ(i) = q} An accepting run is a run with q i T infinitely often : inf(ρ) T Example ρ = q 0 a q 1 b q 0 b q 0 a q 1 b q 0 b q 0 a q 1... on w = ({a}{b}{b}) ω is accepting ρ = q 0 b q 0 b q 0 b q 0... on w = ({b}) ω is not accepting in A from above Lecture 4 Automata on Infinite words and LTL Model Checking 8 / 35

9 Language of a NBA A word w is accepted by a NBW A iff there exists an accepting run on w in A Example (Eventually Globally a (FGa)) For AP = {a, b}, For w = {a}{b}{b}({a}) ω, the run ρ = (q 0) ω is not accepting but ρ = q 0q 0q 0q 0(q 1) ω is accepting and therefore w is accepted For w = ({a}{b}{b}) ω, the possible runs are ρ = (q 0) q 1(q 2) ω or ρ = (q 0) ω w is not accepted The language L(A) of A is the set of words accepted by the automaton A A set L of words is Büchi recognizable if there is a Büchi automaton A s.t. L(A) = L. Lecture 4 Automata on Infinite words and LTL Model Checking 9 / 35

10 NBA - Closure Properties Büchi-recognizable languages are closed under Union, Intersection and Complement: Given two Büchi automata A 1 = 2 AP, Q 1, Q 1 0, δ 1, T 1 and A 2 = 2 AP, Q 2, Q 2 0, δ 2, T 2 We can define Union: A = 2 AP, Q, Q 0, δ, T such that L(A ) = L(A 1) L(A 2) Intersection: A = 2 AP, Q, Q 0, δ, T such that L(A ) = L(A 1) L(A 2) Complement: Ā 1 = 2 AP, Q, Q 0, δ, T such that L(Ā 1) = L(A 1) Lecture 4 Automata on Infinite words and LTL Model Checking 10 / 35

11 NBA - Closure Properties Büchi-recognizable languages are closed under Union, Intersection and Complement: Given two Büchi automata A 1 = 2 AP, Q 1, Q 1 0, δ 1, T 1 and A 2 = 2 AP, Q 2, Q 2 0, δ 2, T 2 We can define Union: A = 2 AP, Q, Q 0, δ, T such that L(A ) = L(A 1) L(A 2) Intersection: A = 2 AP, Q, Q 0, δ, T such that L(A ) = L(A 1) L(A 2) Complement: Ā 1 = 2 AP, Q, Q 0, δ, T such that L(Ā 1) = L(A 1) Difficult to complement Büchi automata (Safra s construction) But, L(A 1 ) = L(ϕ) for some LTL formula and L(A 1 ) = L( ϕ) Build directly the automaton for ϕ! (if we know ϕ) Lecture 4 Automata on Infinite words and LTL Model Checking 10 / 35

12 NBA - Closure Properties: Union Given two Büchi automata A 1 = 2 AP, Q 1, Q 1 0, δ 1, T 1 and A 2 = 2 AP, Q 2, Q 2 0, δ 2, T 2 We define A = 2 AP, Q, Q 0, δ, T Q = Q 1 Q 2 (we can assume Q 1 Q 2 = ) Q 0 = Q 1 0 Q 2 0 δ = δ 1 δ 2 T = T 1 T 2 Theorem L(A ) = L(A 1) L(A 2) Proof. L(A ) L(A 1) L(A 2): For w L(A ), ρ = q 0q 1q 2... accepting run on w if q 0 Q 1, ρ is accepting in A 1 w L(A 1 ) otherwise, q 0 Q 2 and ρ is accepting in A 2 w L(A 2 ) L(A ) L(A 1) L(A 2): For i {1, 2} and w L(A i ), ρ = q 0q 1q 2... accepting run on w in A i But ρ is also an accepting run in A (in the copy of A i ) w L(A ) Lecture 4 Automata on Infinite words and LTL Model Checking 11 / 35

13 NBA - Closure Properties: Intersection (Special Case) Given two Büchi automata (note all states of A 1 are accepting) A 1 = 2 AP, Q 1, Q 1 0, δ 1, Q 1 and A 2 = 2 AP, Q 2, Q 2 0, δ 2, T 2 We define A = 2 AP, Q, Q 0, δ, T Q = Q 1 Q 2 Q 0 = Q 1 0 Q 2 0 ((q 1, q 2), a, (q 1, q 2)) δ iff (q 1, a, q 1) δ 1 and (q 2, a, q 2) δ 2 T = Q 1 T 2 Theorem L(A ) = L(A 1) L(A 2) Proof. ρ = (q 0 1, q 0 2)(q 1 1, q 1 2)(q 2 1, q 2 2)... is a run in A on w iff ρ 1 = q 0 1q 1 1q is a run in A 1 on w and ρ 2 = q 0 2q 1 2q is a run in A 2 on w ρ is accepting iff ρ 1 is accepting and ρ 2 is accepting Lecture 4 Automata on Infinite words and LTL Model Checking 12 / 35

14 NBA - Closure Properties: Intersection (General Case) Given two Büchi automata A 1 = 2 AP, Q 1, Q 1 0, δ 1, T 1 and A 2 = 2 AP, Q 2, Q 2 0, δ 2, T 2 We define A = 2 AP, Q, Q 0, δ, T T has to verify both T 1 and T 2! Key idea: make two copies of the states in Q 1 Q 2 1st copy: Start here, move from here when reached T 1 Q 2 2nd copy: wait for Q 1 T 2 and move to first copy when reached Accept if final states in 2nd copy are seen infinitely often Lecture 4 Automata on Infinite words and LTL Model Checking 13 / 35

15 NBA - Closure Properties: Intersection (General Case) Given two Büchi automata A 1 = 2 AP, Q 1, Q 1 0, δ 1, T 1 and A 2 = 2 AP, Q 2, Q 2 0, δ 2, T 2 We define A = 2 AP, Q, Q 0, δ, T Q = Q 1 Q 2 {1, 2} Q 0 = Q 1 0 Q 2 0 {1} ((q 1, q 2, 1), a, (q 1, q 2, 1)) δ iff (q 1, a, q 1) δ 1, (q 2, a, q 2) δ 2, and q 1 T 1 ((q 1, q 2, 1), a, (q 1, q 2, 2)) δ iff (q 1, a, q 1) δ 1, (q 2, a, q 2) δ 2, and q 1 T 1 ((q 1, q 2, 2), a, (q 1, q 2, 2)) δ iff (q 1, a, q 1) δ 1, (q 2, a, q 2) δ 2, and q 2 T 2 ((q 1, q 2, 2), a, (q 1, q 2, 1)) δ iff (q 1, a, q 1) δ 1, (q 2, a, q 2) δ 2, and q 2 T 2 T = {(q 1, q 2, 2) q 1 Q 1 and q 2 T 2} Theorem L(A ) = L(A 1) L(A 2) Proof. same as in the Special Case Lecture 4 Automata on Infinite words and LTL Model Checking 14 / 35

16 NBA - Closure Properties: Intersection Example Lecture 4 Automata on Infinite words and LTL Model Checking 15 / 35

17 NBA - Closure Properties: Intersection Example Lecture 4 Automata on Infinite words and LTL Model Checking 15 / 35

18 NBA - Closure Properties: Intersection Example Lecture 4 Automata on Infinite words and LTL Model Checking 15 / 35

19 NBA - Closure Properties: Intersection Example Simplification: Remove unreachable states and moving nodes Lecture 4 Automata on Infinite words and LTL Model Checking 15 / 35

20 NBA - Closure Properties: Intersection Example Lecture 4 Automata on Infinite words and LTL Model Checking 15 / 35

21 NBA - Closure Properties: Intersection Example Simplification: Unify the nodes in the trap All simplified automata accept the same language : G(a Fb)! Lecture 4 Automata on Infinite words and LTL Model Checking 15 / 35

22 LTL to NBA Theorem For every LTL formula ϕ over AP, there is a NBA A such that L(A) = {w 2 AP w, 0 = ϕ} Lecture 4 Automata on Infinite words and LTL Model Checking 16 / 35

23 LTL to NBA - Approach The construction of a NBA from a LTL formula is done in three steps: Formula rewriting Rewrite the formula in negative normal form Apply rewriting rules Core translation Turn an LTL formula into a generalized Büchi automaton Degeneralization Turn the general Büchi automaton into a NBA Lecture 4 Automata on Infinite words and LTL Model Checking 17 / 35

24 LTL to NBA - Rewriting Put the formula in Negative Normal Form Negation appears only in front of literals Use the following identities to propagate the negations inwards: ϕ ϕ X ϕ X ϕ Gϕ F ϕ F ϕ G ϕ (ϕ 1 ϕ 2) ( ϕ 1) ( ϕ 2) (ϕ 1 ϕ 2) ( ϕ 1) ( ϕ 2) (ϕ 1Uϕ 2) ( ϕ 1)R( ϕ 2) (ϕ 1Rϕ 2) ( ϕ 1)U( ϕ 2) Definition An LTL formula is in Negative Normal Form (NNF) if it follows the syntax given by ϕ ::= p p ϕ ϕ ϕ ϕ X ϕ ϕuϕ ϕrϕ where p AP is an atomic proposition. Lecture 4 Automata on Infinite words and LTL Model Checking 18 / 35

25 LTL to NBA - Rewriting The size of the automaton will depend on the size of the formula Reduce the number of temporal subformulas by applying other rewriting rules: (X ϕ 1) (X ϕ 2) X (ϕ 1 ϕ 2) (ϕrψ 1) (ϕrψ 2) ϕr(ψ 1 ψ 2) (Gϕ 1) (Gϕ 2) G(ϕ 1 ϕ 2) (X ϕ 1)U(X ϕ 2) X (ϕ 1Uϕ 2) (ψ 1Rϕ) (ψ 2Rϕ) (ψ 1 ψ 2)Rϕ GF ϕ 1 GF ϕ 2 GF (ϕ 1 ϕ 2) Lecture 4 Automata on Infinite words and LTL Model Checking 19 / 35

26 LTL to NBA - Rewriting : Example ϕ 1 = F (p Fq) G (p Fq) Lecture 4 Automata on Infinite words and LTL Model Checking 20 / 35

27 LTL to NBA - Rewriting : Example ϕ 1 = F (p Fq) G (p Fq) G( p Fq) Lecture 4 Automata on Infinite words and LTL Model Checking 20 / 35

28 LTL to NBA - Rewriting : Example ϕ 1 = F (p Fq) G (p Fq) G( p Fq) G( p Fq) Lecture 4 Automata on Infinite words and LTL Model Checking 20 / 35

29 LTL to NBA - Rewriting : Example ϕ 1 = F (p Fq) G (p Fq) G( p Fq) G( p Fq) ϕ 2 = F (p (Xq R X r)) G (p (Xq R X r)) G( p (Xq R X r)) G( p (( Xq) U ( X r))) G( p ((X q) U (X r))) G( p (X q) U (Xr)) G( p X ( q U r)) Lecture 4 Automata on Infinite words and LTL Model Checking 20 / 35

30 LTL to NBA - Core Translation A state of the automaton A ϕ is a consistent set Z of subformulas of ϕ Definition A set Z Sub(ϕ) is consistent if it does not contain or a pair {ψ, ψ}. The formulas in Z are seen as obligations If a run ρ on a word w starts in Z and satisfies the accepting condition, then w, 0 = ψ The only initial state of A ϕ is Z = {ϕ} Transitions to next states are given by the formulas of the form X ψ from Z Need to reduce Z such that all formulas in Z are either literals or have the form X ψ ψ Z Lecture 4 Automata on Infinite words and LTL Model Checking 21 / 35

31 LTL to NBA - Core Translation : Reduction of sets Z Use ɛ-transitions to reduce arbitrary sets Y of formulas they are handy, but will not belong to the final A ϕ Reduction depends on non-reduced formulas ψ Y!ψ means ψ has been postponed marked transitions used to define accepting transitions Lecture 4 Automata on Infinite words and LTL Model Checking 22 / 35

32 LTL to NBA - Core Translation : Example Example (Reduction for ϕ = G(p Fq)) Lecture 4 Automata on Infinite words and LTL Model Checking 23 / 35

33 LTL to NBA - Core Translation Y ɛ Z if there is a sequence of ɛ-transitions from Y to Z Red(Y ) = {Z consistent and reduced Y ɛ Z} Red α(y ) = {Z consistent and reduced Y ɛ Z without using an edge marked with!α} From the definition of the reduction rules, holds: ψ ψ ψ Y Z Red(Y ) ψ Z Lecture 4 Automata on Infinite words and LTL Model Checking 24 / 35

34 LTL to NBA - Core Translation : Example Example (Reduction for ϕ = G(p Fq)) Red({ϕ}) = {{ p, X ϕ}, {q, X ϕ}, {XFq, X ϕ}} Red Fq ({ϕ}) = {{ p, X ϕ}, {q, X ϕ}} Lecture 4 Automata on Infinite words and LTL Model Checking 25 / 35

35 LTL to NBA - Core Translation : Generalized Büchi Automaton Let Σ Z = {a 2 AP p AP, (p Z p a) and ( p Z p a)} Let U(ϕ) = {ψ Sub(ϕ) ψ = ψ 1Uψ 2 or ψ = F ψ 1} the set of until formulas of ϕ Let next(z) = {ψ X ψ Z} The Generalized Büchi Automaton for ϕ is B ϕ = 2 AP, Q, Q 0, δ, (T α) α U(ϕ) Q = 2 Sub(ϕ) Q 0 = {{ϕ}} δ = {Y a next(z) Y Q, a Σ Z and Z Red(Y )} For each α U(ϕ), T α = {Y a next(z) Y Q, a Σ Z and Z Red α(y )} the accepting condition is a set of sets of transitions to be visited infinitely often Asks to net postpone forever the until formulas Lecture 4 Automata on Infinite words and LTL Model Checking 26 / 35

36 LTL to NBA - Core Translation : Example of Construction Example (ϕ = G( p Fq)) Lecture 4 Automata on Infinite words and LTL Model Checking 27 / 35

37 LTL to NBA - Core Translation : Example of Construction Example (ϕ = G( p Fq) - continuation) After removing the intermediate dashed transitions: Lecture 4 Automata on Infinite words and LTL Model Checking 28 / 35

38 LTL to NBA - Core Translation : Example of Construction Example (ϕ = G( p Fq) - continuation) After removing the intermediate dashed transitions: After removing redundant transitions: Lecture 4 Automata on Infinite words and LTL Model Checking 28 / 35

39 LTL to NBA - Degeneralization For B ϕ = 2 AP, Q, Q 0, δ, T 1, T 2,..., T n with n sets in the acceptance condition, Take the synchronous product with the automaton D n below: The Nondeterministic Büchi Automaton for ϕ is then A ϕ = B ϕ D n Lecture 4 Automata on Infinite words and LTL Model Checking 29 / 35

40 LTL to NBA - Degeneralization : Example For ϕ = G( p Fq) A ϕ : Σ p q F q start ϕ = G( p Fq), 0 ϕ, 1 Σ Fq, ϕ, 0 Σ Σ q F q Lecture 4 Automata on Infinite words and LTL Model Checking 30 / 35

41 LTL to NBA - Degeneralization : Example For ϕ = G( p Fq) NBA A ϕ after removing labels F q: A ϕ : Σ p q start ϕ = G( p Fq), 0 ϕ, 1 Σ Σ Fq, ϕ, 0 Σ q Lecture 4 Automata on Infinite words and LTL Model Checking 30 / 35

42 Modeling LTS as NBA A Labeled Transition System T is the set of all its executions Transform a LTS T = AP, S, S 0, R, τ... into NBA A T = 2 AP, Q, Q 0, δ, T where Q = S {l} Q 0 = {l} (l, a, s) δ iff s S 0 and a = τ(s) (s, a, s ) δ iff (s, s ) R and a = τ(s ) T = S {l} l {p, q} s 0 s 1 {p} {p} {p, q} {p} s 0 s 1 {p, q} {q} {p, q} s 2 {q} s 2 LTS T NBA A T Lecture 4 Automata on Infinite words and LTL Model Checking 31 / 35

43 Back to LTL Model Checking Recall: T satisfies the LTL formula ϕ iff Traces(T ) L( ϕ) = Since L(A ϕ) = L( ϕ), T satisfies the LTL formula ϕ iff L(A T A ϕ) = Where A T is the Büchi automaton of size O( T ) s.t. L(A T ) = Traces(T ) A ϕ is the Büchi automaton recognizing models of ϕ obtained as before. Its size is 2 O( ϕ ) is the synchronous product operation If L(A T A ϕ), any behavior in it is an counterexample. Counterexamples are always of the form uv ω, where u and v are finite words Lecture 4 Automata on Infinite words and LTL Model Checking 32 / 35

44 LTL Model Checking - Complexity Theorem Checking whether an LTL formula ϕ is satisfied by a LTS T can be done in time O( T 2 O( ϕ ) ). i.e., checking is polynomial in the size of the model and exponential in the size of the specification. Lecture 4 Automata on Infinite words and LTL Model Checking 33 / 35

45 Emptiness of NBA An Büchi automaton is non-empty iff Is this automaton empty? there exists a path to a cycle containing an accepting state b q 2 c a q 0 q 1 e q 4 f q 3 d Lecture 4 Automata on Infinite words and LTL Model Checking 34 / 35

46 Emptiness of NBA An Büchi automaton is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No : It accepts a(bef ) ω a q 0 q 1 b q 2 e c q 4 f q 3 d Lecture 4 Automata on Infinite words and LTL Model Checking 34 / 35

47 Emptiness of NBA An Büchi automaton is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No : It accepts a(bef ) ω a q 0 q 1 b q 2 e c q 4 f Idea: Consider only reachable states of A Find all maximal strongly connected components: SCC 1, SCC 2, etc. An automaton is non-empty iff exists SCC i containing an accepting state q 3 d Lecture 4 Automata on Infinite words and LTL Model Checking 34 / 35

48 Emptiness of NBA An Büchi automaton is non-empty iff there exists a path to a cycle containing an accepting state Is this automaton empty? No : It accepts a(bef ) ω a q 0 q 1 b q 2 e c q 4 f Idea: Consider only reachable states of A Find all maximal strongly connected components: SCC 1, SCC 2, etc. An automaton is non-empty iff exists SCC i containing an accepting state q 3 d Consequence: The language of any Büchi automata is of the form X (Y ) ω where X and Y are regular languages of finite words. Lecture 4 Automata on Infinite words and LTL Model Checking 34 / 35

49 Bibliography Stéphane Demri & Paul Gastin - Specification and Verification using Temporal Logics : cefb dc412fb1b29edcdc59a13e5df.pdf Bakhadyr Khoussainov and Anil Nerode: Automata Theory and its Applications (available online) Erich Grädel et al: Automata, Logics, and Infinite Games - A Guide to Current Research(available online) Lecture 4 Automata on Infinite words and LTL Model Checking 35 / 35